The OVAL Repository 5.4 2015-09-03T07:03:22.384-04:00 HP-UX 11 Unspecified vulnerability in HP-UX B.11.23 on Itanium platforms allows local users to cause a denial of service due to a "specific stack size." Robert L. Hollis DRAFT Matthew Wojcik INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Michael Wood INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unknown vulnerability in HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and B.11.23, when running TCP/IP on IPv4, allows remote attackers to cause a denial of service via certain packets, related to the PMTU, a different vulnerability than CVE-2004-1060. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 does not properly parse color profiles, which allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862970. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted DER encoded data, which is not properly decoded by the ASN.1 DER input stream parser, aka Bug Id 6864911. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via large subsample dimensions in a JPEG file that triggers a heap-based buffer overflow, aka Bug Id 6874643. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lacks the final keyword. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862969. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file, which leads to a heap-based buffer overflow during decompression. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, related to a "quantization problem," aka Bug Id 6862968. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP headers, which are not properly parsed by the ASN.1 DER input stream parser, aka Bug Id 6864911. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP Enterprise Cluster Master Toolkit (ECMT) B.05.00 on HP-UX B.11.23 (11i v2) and HP-UX B.11.31 (11i v3) allows local users to gain access to an Oracle or Sybase database via unknown vectors. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via crafted arguments, aka Bug Id 6872358. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Protection Server (CPS) 11d, 12.0, and 12.5; Veritas NetBackup Operations Manager (NOM) 6.0 GA through 6.5.5; Veritas Backup Reporter (VBR) 6.0 GA through 6.6; Veritas Storage Foundation (SF) 3.5; Veritas Storage Foundation for Windows High Availability (SFWHA) 4.3MP2, 5.0, 5.0RP1a, 5.0RP2, 5.1, and 5.1AP1; Veritas Storage Foundation for High Availability (SFHA) 3.5; Veritas Storage Foundation for Oracle (SFO) 4.1, 5.0, and 5.0.1; Veritas Storage Foundation for DB2 4.1 and 5.0; Veritas Storage Foundation for Sybase 4.1 and 5.0; Veritas Storage Foundation for Oracle Real Application Cluster (SFRAC) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Manager (SFM) 1.0, 1.0 MP1, 1.1, 1.1.1Ux, 1.1.1Win, and 2.0; Veritas Cluster Server (VCS) 3.5, 4.0, 4.1, and 5.0; Veritas Cluster Server One (VCSOne) 2.0, 2.0.1, and 2.0.2; Veritas Application Director (VAD) 1.1 and 1.1 Platform Expansion; Veritas Cluster Server Management Console (VCSMC) 5.1, 5.5, and 5.5.1; Veritas Storage Foundation Cluster File System (SFCFS) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Cluster File System for Oracle RAC (SFCFS RAC) 5.0; Veritas Command Central Storage (CCS) 4.x, 5.0, and 5.1; Veritas Command Central Enterprise Reporter (CC-ER) 5.0 GA, 5.0 MP1, 5.0 MP1RP1, and 5.1; Veritas Command Central Storage Change Manager (CC-SCM) 5.0 and 5.1; and Veritas MicroMeasure 5.0 does not properly validate authentication requests, which allows remote attackers to trigger the unpacking of a WAR archive, and execute arbitrary code in the contained files, via crafted data to TCP port 14300. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to spoof HMAC-based digital signatures, and possibly bypass authentication, via unspecified vectors related to "timing attack vulnerabilities," aka Bug Id 6863503. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in usermod in HP-UX B.11.00, B.11.11, and B.11.23, when run with certain options that involve a new home directory, might cause usermod to change the ownership of all directories and files under the new directory, which might result in less secure permissions than intended. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Michael Wood INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted (1) applets and (2) Java Web Start applications, which allows remote attackers to hijack web sessions via unspecified vectors. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Unspecified vulnerability in usermod in HP-UX B.11.00, B.11.11, and B.11.23, when run with certain options that involve a new home directory, might cause usermod to change the ownership of all directories and files under the new directory, which might result in less secure permissions than intended. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM Nabil Ouchn ACCEPTED ACCEPTED HP-UX 11 Unknown vulnerability in remshd daemon in HP-UX B.11.00, B.11.11, and B.11.23 while running in "Trusted Mode" allows remote attackers to gain unauthorized system access via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Michael Wood INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack vectors related to "missing sanity checks around exif processing." Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1) interrupt corruption of the SESSION superglobal array and (2) the session.save_path directive. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass safe_mode restrictions, and create files in group-writable or world-writable directories, via the dir and prefix arguments. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The php_openssl_apply_verification_policy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Perl Race condition in the rmtree function in File::Path.pm in Perl before 5.8.4 allows local users to create arbitrary setuid binaries in the tree being deleted, a different vulnerability than CVE-2004-0452. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories. Aslesha Nargolkar DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LD_LIBRARY_PATH environment variable. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Integer signedness error in the gssrpc__svcauth_unix function in svc_auth_unix.c in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a negative length value. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Software Distributor (sd) in HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges via unknown vectors. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the imagecolortransparent function in PHP before 5.2.11 has unknown impact and attack vectors related to an incorrect "sanity check for the color index." Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname. Aslesha DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains (1) CNAME or (2) DNAME records, which do not have the intended validation before caching, aka Bug 20737. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4022. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 The exif_read_data function in the Exif module in PHP before 5.2.10 allows remote attackers to cause a denial of service (crash) via a malformed JPEG image with invalid offset fields, a different issue than CVE-2005-3353. Chandan M C DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 ftpd wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Samba Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a Samba request with a large number of security descriptors that triggers a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmetic. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP-UX B.11.11 running VERITAS Oracle Disk Manager (VRTSodm) 3.5, B.11.23 running VRTSodm 4.1 or VERITAS File System (VRTSvxfs) 4.1, B.11.23 running VRTSodm 5.0 or VRTSvxfs 5.0, and B.11.31 running VRTSodm 5.0 allows local users to gain root privileges via unknown vectors. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Role-Based Access Control (RBAC) in HP HP-UX B.11.23 and B.11.31 allows local users to bypass intended access restrictions via unknown vectors. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED Jaikumar INTERIM ACCEPTED ACCEPTED HP-UX 11 The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP-UX B.11.31 allows local users to cause a denial of service (system crash) via unknown vectors related to the ttrace system call. Pai Peng DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 swagentd Unspecified vulnerability in swagentd in HP-UX B.11.00, B.11.04, and B.11.11 allows remote attackers to cause a denial of service (application crash) via unspecified vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple memory leaks in Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 and earlier allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) the authentication / bind phase and (2) anonymous LDAP search requests. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Java Web Start in Sun JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.2_15 and earlier, on Windows does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read local files via an untrusted application. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 HP-UX B.11.00 and B.11.11 with B6848AB GTK+ Support Libraries installed uses insecure directory permissions, which allows local users to gain privileges via files in /opt/gnome/src/GLib/. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP-UX B.11.23, when running IPFilter in combination with PHNE_34474, allows remote attackers to cause a denial of service (system crash) via unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote attackers to cause a denial of service (CPU consumption and search outage) via crafted LDAP search requests with patterns, related to a single-threaded regular-expression subsystem. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the kernel in HP HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors. Pai Peng DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Automount daemon automountd allows local or remote users to gain privileges via shell metacharacters. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 CRLF injection vulnerability in the FILTER_VALIDATE_EMAIL filter in ext/filter in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to inject arbitrary e-mail headers via an e-mail address with a '\n' character, which causes a regular expression to ignore the subsequent part of the address string. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safe_mode and open_basedir restrictions and possibly execute arbitrary commands, as demonstrated using (a) php_value, (b) php_flag, and (c) directives in .htaccess. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP LDAP-UX vB.04.10 through vB.04.15 allows local users to gain privileges via unknown vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Buffer overflows and other vulnerabilities in multiple Common Desktop Environment (CDE) modules in HP-UX 10.10 through 11.11 allow attackers to cause a denial of service and possibly gain additional privileges. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in xterm for HP-UX 11.00, 11.11, and 11.23 allows local users to gain privileges via unknown vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Michael Wood INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 ftpd.c in (1) wu-ftpd 2.4.2 and (2) ftpd in HP HP-UX B.11.11 assigns uid 0 to the FTP client in certain operating-system misconfigurations in which PAM authentication can succeed even though no passwd entry is available for a user, which allows remote attackers to gain privileges, as demonstrated by a login attempt for an LDAP account when nsswitch.conf does not specify LDAP for passwd information. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in CDE Print Viewer (dtprintinfo) allows local users to execute arbitrary code by copying text from the clipboard into the Help window. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.11 and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors. NOTE: this is probably different from CVE-2007-0916, but this is not certain due to lack of vendor details. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 The IPv6 Neighbor Discovery Protocol (NDP) implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity), read private network traffic, and possibly execute arbitrary code via a spoofed message that modifies the Forward Information Base (FIB), a related issue to CVE-2008-2476. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Vacation program allows command execution by remote users through a sendmail command. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in libnsl in Sun Solaris 8 and 9 allows remote attackers to cause a denial of service (crash) via malformed RPC requests that trigger a crash in rpcbind. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Java Web Start in Sun JDK and JRE 6 Update 2 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read and modify local files via an untrusted application, aka "two vulnerabilities." Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox before 2.0.0.7 installed, allows remote attackers to execute arbitrary commands via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter containing the Firefox "-chrome" argument. NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject arbitrary web script or HTML via input values that use % (percent) escaping. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in OpenSSL before A.00.09.07l on HP-UX B.11.11, B.11.23, and B.11.31 allows local users to cause a denial of service via unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple buffer overflows in the adminutil library in CGI applications in Red Hat Directory Server 7.1 before SP7 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted Accept-Language HTTP header. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in libc on HP HP-UX B.11.23 and B.11.31 allows remote attackers to cause a denial of service via unknown vectors. Michael Wood DRAFT INTERIM ACCEPTED Pai Peng INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM Prashant Kumar ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Denial of service in HP-UX sendmail 8.8.6 related to accepting connections. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the HP System Administration Manager (SAM) on HP-UX B.11.11 and B.11.23, when used to configure NFS, might allow remote attackers to read or modify arbitrary files, related to an "empty systems list." Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operating as a WINS server, allows remote attackers to execute arbitrary code via crafted WINS Name Registration requests followed by a WINS Name Query request. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Format string vulnerability in the swask command in HP-UX B.11.11 and possibly other versions allows local users to execute arbitrary code via format string specifiers in the -s argument. NOTE: this might be a duplicate of CVE-2006-2574, but the details relating to CVE-2006-2574 are too vague to be certain. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in useradd in HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to access arbitrary files and directories via unknown vectors, a different issue than CVE-2008-1660. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Vulnerability in the newgrp program included with HP9000 servers running HP-UX 11.11 allows a local attacker to obtain higher access rights. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in CDE libDtSvc on HP-UX B.11.00, B.11.04, B.11.11, and B.11.22 allows local users to gain root privileges via unknown vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 shar on HP-UX B.11.00, B.11.04, and B.11.11 creates temporary files with predictable names in /tmp, which allows local users to cause a denial of service and possibly execute arbitrary code via a symlink attack. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflows in HP Software Distributor (SD) for HPUX 10.x and 11.x. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in bootpd in HP HP-UX B.11.11, B.11.23, and B.11.31 allows remote attackers to cause a denial of service via unknown attack vectors. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The logins command in HP-UX B.11.31, B.11.23, and B.11.11 does not correctly report password status, which allows remote attackers to obtain privileges when certain "password issues" are not detected. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 HP-UX B.11.00 through B.11.23, when running Ignite-UX and using the add_new_client command, causes the TFTP server to set world-writable permissions on part of the directory tree, which allows remote attackers to modify data or cause disk consumption. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Multiple cross-site scripting (XSS) vulnerabilities in HP System Management Homepage (SMH) in HP-UX B.11.11, B.11.23, and B.11.31, and SMH before 2.1.10 for Linux and Windows, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 The dl function in PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in the library parameter. NOTE: there are limited usage scenarios under which this would be a vulnerability. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The Xserver for HP-UX 11.22 was not properly built, which introduced a vulnerability that allows local users to gain privileges. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 RLPDaemon in HP-UX 10.20 and 11.0 allows local users to overwrite arbitrary files and gain privileges by specifying the target file in the -L option. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug." Michael Wood INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows remote attackers to cause a denial of service via a "Rose Attack" that involves sending a subset of small IP fragments that do not form a complete, larger packet. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 The "file handling" in sort in HP-UX 10.01 through 10.20, and 11.00 through 11.11 is "incorrect," which allows attackers to gain access or cause a denial of service via unknown vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Denial of service in HP-UX SharedX recserv program. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in the pfs_mountd.rpc RPC daemon in the Portable File System (PFS) in HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to execute arbitrary code by sending "a call to procedure 5, followed by a crafted payload to procedure 2." Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in X.25 on HP-UX B.11.00, B.11.11, and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors. Michael Wood Michael Wood INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the kernel in HP-UX B.11.00, B.11.11, and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 A later variation on the Teardrop IP denial of service attack, a.k.a. Teardrop-2. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The NSAPI plugins for TGA and the Java Servlet proxy in HP-UX VVOS 10.24 and 11.04 allows an attacker to cause a denial of service (high CPU utilization). Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in rpc.yppasswdd in HP HP-UX B.11.11, B.11.23, and B.11.31 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29 allows remote attackers to execute arbitrary code via a crafted SMB response. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflows in lpspooler in the fileset PrinterMgmt.LP-SPOOL of HP-UX 11.0 and earlier allows local users to gain privileges. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The June 1999 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the awk command. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Land IP denial of service. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in the sw_rpc_agent_init function in swagentd in Software Distributor (SD), and possibly other DCE applications, in HP HP-UX B.11.11 and B.11.23 allows remote attackers to execute arbitrary code or cause a denial of service via malformed arguments in an opcode 0x04 DCE RPC request. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the FTP Daemon (ftpd) for HP Tru64 UNIX 4.0F PK8 and other versions up to HP Tru64 UNIX 5.1B-3, and HP-UX B.11.00, B.11.04, B.11.11, and B.11.23, allows remote authenticated users to cause a denial of service (hang). Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the kernel in HP-UX B.11.00 allows local users to cause an unspecified denial of service via unknown vectors. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in the FTP daemon in HP-UX 11.11i, with the -v (debug) option enabled, allows remote attackers to execute arbitrary code via a long command request. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 JFS (JFS3.1 and OnlineJFS) in HP-UX 10.20, 11.00, and 11.04 does not properly implement the sticky bit functionality, which could allow attackers to bypass intended restrictions on filesystems. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 HP Event Correlation Service (ecsd) as included with OpenView Network Node Manager 6.1 allows a remote attacker to gain addition privileges via a buffer overflow attack in the '-restore_config' command line parameter. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport software in HP-UX B.11.00, B.11.04, and B.11.11 before 20040628 allows local users to cause a denial of service via unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unknown vulnerability in BIND 9.2.0 in HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to cause a denial of service. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 rpcbind in HP-UX 11.00, 11.04 and 11.11 allows remote attackers to cause a denial of service (core dump) via a malformed RPC portmap requests, possibly related to a buffer overflow. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in mkdir in HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows local users to gain privileges via unknown attack vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Vulnerability in CIFS/9000 Server (SAMBA) A.01.06 and earlier in HP-UX 11.0 and 11.11, when configured as a print server, allows local users to overwrite arbitrary files by modifying certain resources. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB). Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP Ignite-UX server before C.6.9.150 for HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to "gain root access" via unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Vulnerability in login in HP-UX 11.00, 11.11, and 10.20 allows restricted shell users to bypass certain security checks and gain privileges. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Vulnerability in newgrp command in HP-UX 11.0 allows local users to gain privileges. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Vulnerability in auto_parms and set_parms in HP-UX 11.00 and earlier allows remote attackers to execute arbitrary commands or cause a denial of service. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 RFC-NETBIOS in HP Advanced Server/9000 B.04.05 through B.04.09, when running HP-UX 11.00 or 11.11, allows remote attackers to cause a denial of sevrice (panic) via a malformed UDP packet on port 139. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in nmbd in Samba 3.0.0 through 3.0.26a, when configured as a Primary or Backup Domain controller, allows remote attackers to have an unknown impact via crafted GETDC mailslot requests, related to handling of GETDC logon server requests. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple unspecified vulnerabilities in the Internet Key Exchange version 1 (IKEv1) implementation in HP HP-UX B.11.00, B.11.11, and B.11.23 running IPSec, HP Jetdirect 635n IPv6/IPsec Print Server, and HP Tru64 UNIX 5.1B-3 and 5.1B-2/PK4, allow remote attackers to cause a denial of service via certain IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the HP advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, and/or CVE-2005-3668 this issue applies to. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Software Distributor in HP-UX B.11.11 allows remote attackers to gain access via unspecified attack vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in Kermit communications software in HP-UX 11.0 and earlier allows local users to cause a denial of service and possibly execute arbitrary commands. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 HP-UX aserver program allows local users to gain privileges via a symlink attack. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP-UX B.11.11 and B.11.23 CIFS Server (Samba) allows local users to gain privileges or obtain "unauthorized access" via unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 kmmodreg in HP-UX 11.11, 11.04 and 11.00 allows local users to create arbitrary world-writeable files via a symlink attack on the (1) /tmp/.kmmodreg_lock and (2) /tmp/kmpath.tmp temporary files. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Support Tools Manager (xstm, cstm, and stm) on HP-UX B.11.11 and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.00 allows local users to cause a denial of service via unknown vectors. NOTE: due to lack of vendor details, it is not clear whether this is the same as CVE-2007-0916. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Vulnerability in swinstall for HP-UX 11.00 and 11.11 allows local users to view obtain data views for files that cannot be directly read by the user, which reportedly can be used to cause a denial of service. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unknown vulnerability in newgrp in HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain elevated privileges. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 asecure as included with HP-UX 10.01 through 11.00 can allow a local attacker to create a denial of service and gain additional privileges via unsafe permissions on the asecure program, a different vulnerability than CVE-2000-0083. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP-UX B.11.00 to B.11.23, when IPSEC is running, allows remote attackers to have unknown impact. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in rexec on HP-UX B.10.20, B.11.00, and B.11.04, when setuid root, may allow local users to gain privileges via a long -l option. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled, allows remote attackers to execute arbitrary code via a GETDC mailslot request composed of a long GETDC string following an offset username in a SAMLOGON logon request. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unknown vulnerability in pam_authz in the LDAP-UX Integration product on HP-UX 11.00 and 11.11 allows remote attackers to execute r-commands with privileges of other users. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in stmkfont utility of HP-UX 10.0 through 11.22 allows local users to gain privileges via a long command line argument. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 ptrace on HP-UX 11.00 through 11.11 allows local users to cause a denial of service (data page fault panic) via "an incorrect reference to thread register state." Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Teardrop IP denial of service. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Vulnerability in shutdown command for HP-UX 11.X and 10.X allows allows local users to gain privileges via malformed input variables. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The ToolTalk ttsession daemon uses weak RPC authentication, which allows a remote attacker to execute commands. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple unspecified vulnerabilities in Software Distributor in HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allow local users to gain privileges via unspecified attack vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in useradd on HP-UX B.11.11, B.11.23, and B.11.31 allows local users to access arbitrary files and directories via unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP-UX B.11.00, B.11.11 and B.11.23, when running in trusted mode, allows local users to cause a denial of service via unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Multiple unknown vulnerabilities in the "r-cmnds" (1) remshd, (2) rexecd, (3) rlogind, (4) rlogin, (5) remsh, (6) rcp, (7) rexec, and (8) rdist for HP-UX 10.00 through 11.00 allow attackers to gain privileges or access files. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The October 1998 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the ps and grep commands. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Aries PA-RISC emulator on HP-UX B.11.23 and B.11.31 on the IA-64 platform allows local users to obtain unspecified access. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 ftp on HP-UX 11.00 allows local users to gain privileges. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 stmkfont in HP-UX B.11.00 through B.11.23 relies on the user-specified PATH when executing certain commands, which allows local users to execute arbitrary code by modifying the PATH environment variable to point to malicious programs. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in line printer daemon (rlpdaemon) in HP-UX 10.01 through 11.11 allows remote attackers to execute arbitrary commands. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Vulnerability in passwd for HP-UX 11.00 and 11.11 allows local users to corrupt the password file and cause a denial of service. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 The get_system_info command in Ignite-UX C.7.0 through C.7.3, and DynRootDisk (DRD) A.1.0.16.417 through A.2.0.0.592, on HP-UX B.11.11, B.11.23, and B.11.31 does not inform local users of networking changes made by the command, which has unknown impact and attack vectors. Michael Wood DRAFT Michael Wood INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Vulnerability in inetd server in HP-UX 11.04 and earlier allows attackers to cause a denial of service when the "swait" state is used by a server. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the LP subsystem in HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows remote attackers to cause a denial of service via unknown vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unknown vulnerability in ndd for HP-UX 11.11 with certain TRANSPORT patches allows attackers to cause a denial of service. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in CDE Calendar Manager Service Daemon (rpc.cmsd). Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Dynamically Loadable Kernel Module (dlkm) static kernel symbol table in HP-UX 11.11 is not properly configured, which allows local users to gain privileges. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 The kernel in HP-UX 11.11 does not properly provide arguments for setrlimit, which could allow local attackers to cause a denial of service (kernel panic) and possibly gain privileges. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in the Software Distributor utilities for HP-UX B.11.00 and B.11.11 allows local users to execute arbitrary code via a long LANG environment variable to setuid programs such as (1) swinstall and (2) swmodify. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unknown vulnerability in ftpd on HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and B.11.23 allows remote authenticated users to gain "unauthorized access to files." Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in wall for HP-UX 10.20 through 11.11 may allow local users to execute arbitrary code by calling wall with a large file as an argument. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP-UX B.11.31, when running ARPA Transport, allows remote attackers to cause a denial of service via unknown vectors. Michael Wood DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unknown vulnerability in System Administration Manager (SAM) in HP-UX B.11.00, B.11.11, B.11.22, and B.11.23 allows local users to gain privileges. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport software in HP-UX B.11.11 and B.11.23 before 20060912 allows local users to cause a denial of service via unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response. Pai Peng DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED Jaikumar INTERIM ACCEPTED ACCEPTED HP-UX 11 geteuid in Itanium Architecture (IA) running on HP-UX 11.20 does not properly identify a user's effective user id, which could allow local users to gain privileges. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in the sqlite_decode_binary function in the bundled sqlite library in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter, as demonstrated by calling the sqlite_udf_decode_binary function with a 0x01 character. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Vulnerability in Predictive on HP-UX 11.0 and earlier, and MPE/iX 5.5 and earlier, allows attackers to compromise data transfer for Predictive messages (using e-mail or modem) between customer and Response Center Predictive systems. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the ied command in HP-UX 10.10, 10.20, and 11.0 allows local users to view "normally invisible data" via unknown attack vectors. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 rpc.pcnfsd in HP gives remote root access by changing the permissions on the main printer spool directory. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the FTP server for HP-UX B.11.11, B.11.23, and B.11.31 allows remote authenticated users to cause a denial of service (FTP server outage) via unknown attack vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.11, B.11.23, and B.11.31 allows remote attackers to cause an unspecified denial of service via unknown vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.11 and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Domain Enterprise Server Management System (DESMS) in HP-UX allows local users to gain privileges. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Vulnerability in top in HP-UX 11.04 and earlier allows local users to overwrite files owned by the "sys" group. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in dtmail on HP Tru64 UNIX 4.0F through 5.1B and HP-UX B.11.00 through B.11.23 allows local users to execute arbitrary code via a long -a (aka attachment) argument. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 setrlimit in HP-UX 10.01, 10.10, 10.24, 10.20, 11.00, 11.04 and 11.11 does not properly enforce core file size on processes after setuid or setgid privileges are dropeed, which could allow local users to cause a denial of service by exhausting available disk space. Michael Wood DRAFT INTERIM Michael Wood ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Partition Manager (parmgr) in HP-UX B.11.23 does not properly validate certificates that are provided by the cimserver, which allows attackers to obtain sensitive data or gain privileges. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 HP asecure creates the Audio Security File audio.sec with insecure permissions, which allows local users to cause a denial of service or gain additional privileges. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in the (1) swpackage and (2) swmodify commands in HP-UX B.11.11 and possibly other versions allows local users to execute arbitrary code via a long -S argument. NOTE: this might be a duplicate of CVE-2006-2574, but the details relating to CVE-2006-2574 are too vague to be certain. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in xntpd of HP-UX 10.20 through 11.11 allows remote attackers to cause a denial of service (hang) via unknown attack vectors. Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in rwrite for HP-UX 11.0 could allow local users to execute arbitrary code via a long argument. NOTE: the vendor was unable to reproduce the problem on a system that had been patched for an lp vulnerability (CVE-2002-1473). Michael Wood DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 AutoRAID Manager Possible unknown vulnerability or vulnerabilities in HP DiskArray Utilities with AutoRAID Manager. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 swagentd Unspecified vulnerability in swagentd in HP-UX B.11.00, B.11.04, and B.11.11 allows remote attackers to cause a denial of service (application crash) via unspecified vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue. Jaikumar DRAFT DRAFT HP-UX 11 The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function. Jaikumar DRAFT DRAFT HP-UX 11 name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier. Jaikumar DRAFT DRAFT HP-UX 11 The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data. Jaikumar DRAFT DRAFT HP-UX 11 The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allows remote attackers to cause a denial of service (infinite loop) via a session that uses an Elliptic Curve algorithm, as demonstrated by an attack against a server that supports client authentication. Jaikumar DRAFT DRAFT HP-UX 11 Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback. Jaikumar DRAFT DRAFT HP-UX 11 The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate. Jaikumar DRAFT DRAFT HP-UX 11 Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the php_date_initialize_from_hash function. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such." JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and Jrockit R27.8.3 and R28.3.3 allows remote attackers to affect confidentiality via vectors related to JAXP. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c. Jaikumar DRAFT INTERIM Jaikumar Kulkarni ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6585. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Internet Explorer, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u67 and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the installation process. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets. Jaikumar Mike Cokus ACCEPTED Jaikumar INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. Jaikumar Mike Cokus ACCEPTED Jaikumar INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6585. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors reelated to 2D, a different vulnerability than CVE-2014-6591. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6476. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Jaikumar Mike Cokus ACCEPTED Jaikumar INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, and 7u67, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6585. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 8u20 and JavaFX 2.2.65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. Jaikumar Mike Cokus ACCEPTED Jaikumar INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function. Jaikumar Mike Cokus ACCEPTED Jaikumar INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6527. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations. Jaikumar DRAFT INTERIM Jaikumar Kulkarni ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue became relevant after the CVE-2014-3568 fix. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors reelated to 2D, a different vulnerability than CVE-2014-6591. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors reelated to 2D, a different vulnerability than CVE-2014-6591. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before 9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R4-P1 allows remote DNS servers to cause a denial of service (assertion failure and daemon exit) via a negative response containing large RRSIG RRsets. Puneeth DRAFT INTERIM Prashant Kumar ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 HP HP-UX B.11.11, B.11.23, and B.11.31, when the PAM configuration includes libpam_updbe, allows remote authenticated users to bypass authentication, and consequently execute arbitrary code, via unspecified vectors. Prashant Kumar Prashant Kumar Mike Cokus Mike Cokus ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals. Puneeth DRAFT INTERIM Prashant Kumar ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c. JaiKumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532. Ganesh Manal DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 3.2.3 on HP-UX B.11.23, and before 3.2.8 on HP-UX B.11.31, allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the kernel in HP HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u60 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-2483. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Serviceability. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u60 and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-4223. NOTE: the previous information is from the July 2014 CPU. Oracle has not commented on another vendor's claim that the issue is related to improper restriction of the "use of privileged annotations." Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to "Diffie-Hellman key agreement." Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect integrity via unknown vectors related to Libraries. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and JavaFX 2.2.51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4208. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Security. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Swing. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, SE 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-0451. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0458 and CVE-2014-2423. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXB. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via unknown vectors related to Deployment. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Libraries. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality via unknown vectors related to 2D. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via vectors related to JNDI. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u51 and 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the BlackBerry PlayBook tablet before 2.0.0.7971 and other products, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a Batched (aka AndX) request that triggers infinite recursion. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect integrity via unknown vectors related to Deployment. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 The png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via (1) a PLTE chunk of zero bytes or (2) a NULL palette, related to pngrtran.c and pngset.c. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-2402. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4220. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-0458. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0455 and CVE-2014-2402. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-2412. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Libraries. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect availability via unknown vectors related to Security. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-0455. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via vectors related to JAXP. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality and integrity via vectors related to JMX. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and JRockit R27.8.1 and R28.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Javadoc. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability. Prashant Kumar DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the the Security component does not properly handle null XML namespace (xmlns) attributes during XML document canonicalization, which allows attackers to escape the sandbox. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in m4 in HP HP-UX B.11.23 and B.11.31 allows local users to obtain sensitive information or modify data via unknown vectors. Ganesh Manal DRAFT INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in rpc.lockd in the NFS subsystem in HP HP-UX B.11.11 and B.11.23 allows remote attackers to cause a denial of service via unknown vectors. Sushant Kumar Singh DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP HP-UX Whitelisting (aka WLI) before A.01.02.02 on HP-UX B.11.31 allows local users to bypass intended access restrictions via unknown vectors. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via unknown vectors related to Security. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via vectors related to JGSS. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via vectors related to AWT. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via vectors related to JAXP. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via vectors related to SCRIPTING. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via vectors related to BEANS. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u25 and earlier, and Java SE Embedded 7u25 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE and JavaFX components in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality via unknown vectors. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing, a different vulnerability than CVE-2013-5806. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 OpenSSL before 0.9.8k on WIN64 and certain other platforms does not properly handle a malformed ASN.1 structure, which allows remote attackers to cause a denial of service (invalid memory access and application crash) by placing this structure in the public key of a certificate, as demonstrated by an RSA public key. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, and JavaFX 2.2.40 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to 2D. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via vectors related to JAX-WS. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, 6u60 and earlier, 5.0u51 and earlier, and Embedded 7u40 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, and JRockit R27.7.6 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Javadoc. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing, a different vulnerability than CVE-2013-5805. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, 6u60 and earlier, 5.0u51 and earlier, and Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to 2D. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u40 and earlier and Java SE 6u60 and earlier allows remote attackers to affect integrity via unknown vectors related to jhat. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE and JavaFX components in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JavaFX 2.2.40 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and JavaFX 2.2.40 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Swing. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2, and 9.6-ESV before 9.6-ESV-R10-P2, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver that uses the NSEC3 signing feature. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE, Java SE Embedded component in Oracle Java SE Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and JavaFX 2.2.40 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Javadoc. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 allows remote attackers to affect availability via unknown vectors. Sushant Kumar Singh DRAFT Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-3136. NOTE: Oracle has not commented on claims from a downstream vendor that this issue is related to "XMLDecoder security issue via ClassFinder." Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality via unknown vectors related to Security. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, 1.4.2_38 and earlier, and JavaFX 2.2 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-1682. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Security. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JMX. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier and 6 Update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows local users to affect confidentiality via unknown vectors related to printing on Solaris or Linux. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to CORBA. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality and integrity, related to JMX. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1721. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, 1.4.2_37 and earlier, and JavaFX 2.1 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1722. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, and 6 Update 30 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install and the Java Update mechanism. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Hotspot. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier, and 6 Update 34 and earlier, has no impact and remote attack vectors involving AWT and "a security-in-depth issue that is not directly exploitable but which can be used to aggravate security vulnerabilities that can be directly exploited." NOTE: this identifier was assigned by the Oracle CNA, but CVE is not intended to cover defense-in-depth issues that are only exposed by the presence of other vulnerabilities. NOTE: Oracle has not commented on claims from a downstream vendor that this issue is related to "toolkit internals references." Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote authenticated users to have an unspecified impact via unknown vectors related to Networking. NOTE: the Oracle CPU states that this issue has a 0.0 CVSS score. If so, then this is not a vulnerability and this issue should not be included in CVE. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Serialization. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Swing. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to HotSpot. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote attackers to affect confidentiality and availability via unknown vectors related to Sound. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Networking. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier; and JavaFX 2.0.2 and earlier; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 unlzh.c in the LHZ component in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted GZIP archive. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Concurrency. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack (MMA) adaptive chosen ciphertext attack. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and integrity, related to JSSE. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Swing. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of service (crash), and possibly obtain sensitive information in applications that use OpenSSL, via a malformed ClientHello handshake message that triggers an out-of-bounds memory access, aka "OCSP stapling vulnerability." Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Integer overflow in the fbShmPutImage function in the MIT-SHM extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to read arbitrary process memory via crafted values for a Pixmap width and height. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP Serviceguard A.11.19 and A.11.20 allows remote attackers to cause a denial of service via unknown vectors. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "integer overflow checks." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, related to JMX. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC 3779 support is enabled, allows remote attackers to cause a denial of service (assertion failure) via an X.509 certificate containing certificate-extension data associated with (1) IP address blocks or (2) Autonomous System (AS) identifiers. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer underflow in the build_tree function in unpack.c in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted leaf count table that causes a write to a negative index. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and the (3) SProcSecurityGenerateAuthorization function in the Security extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via requests with crafted length values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality and integrity via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to weak permissions for shared memory. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-1569, CVE-2013-2384, and CVE-2013-2420. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "handling of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS applications, which allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an out-of-bounds read. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4108. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect integrity, related to CORBA. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to frame injection in HTML that is generated by Javadoc. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; JavaFX 2.2.7 and earlier; and OpenJDK 6 and 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to ImageIO. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "JPEGImageReader state corruption" when using native code. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image layout verification" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via "an error related to method handles." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-2463, CVE-2013-2465, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, and CVE-2013-2473. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to insufficient "validation of images" in share/native/sun/awt/image/awt_ImageRep.c, possibly involving offsets. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to JMX. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to an incorrect implementation of "certain class checks" that allows remote attackers to bypass intended class restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to insufficient "access restrictions" and "robustness of sound classes." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The XInput extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via requests related to byte swapping and heap corruption within multiple functions, a different vulnerability than CVE-2007-4990. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (crash) via a crafted GZIP (gz) archive, which results in a NULL dereference. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image attribute verification" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2400. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, and JRockit R28.1.4 and earlier allows remote authenticated users to affect confidentiality, related to JAXWS. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Serialization. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper access checks for subclasses in the ObjectOutputStream class. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions" in the LogStream.setDefaultStream method. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to insufficient "access restrictions" and "robustness of sound classes." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to frame injection in HTML that is generated by Javadoc. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2443 and CVE-2013-2455. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "network address handling in virtual machine identifiers" and the lack of "unique and unpredictable IDs" in the java.rmi.dgc.VMID class. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality and integrity via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to weak permissions for shared memory. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in OpenSSL 1.0.1 before 1.0.1d allows remote attackers to cause a denial of service (application crash) via crafted CBC data. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via vectors related to CORBA. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue does not properly enforce access restrictions for CORBA output streams. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality via vectors related to JMX. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient class access checks" when "creating new instances" using MBeanInstantiator. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "ImagingLib byte lookup processing." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ByteBandedRaster size checks" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect availability via unknown vectors related to Security. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2442 and CVE-2013-2468. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect availability via unknown vectors related to Serialization. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper handling of circular references in ObjectStreamClass. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to I18n. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Serialization. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper access checks for subclasses in the ObjectOutputStream class. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to JMX. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to an incorrect implementation of "certain class checks" that allows remote attackers to bypass intended class restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to insufficient indication of an SSL connection failure by JConsole, related to RMI connection dialog box. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to insufficient "access restrictions" and "robustness of sound classes." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the WBEM implementation in HP HP-UX 11.11 and 11.23 allows remote attackers to obtain access to diagnostic information via unknown vectors, a related issue to CVE-2012-0125. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted TLS packet that is not properly handled during a certain explicit IV calculation. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2443 and CVE-2013-2452. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect access checks by the (1) getEnclosingClass, (2) getEnclosingMethod, and (3) getEnclosingConstructor methods. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image attribute verification" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the WBEM implementation in HP HP-UX 11.31 allows local users to obtain access to diagnostic information via unknown vectors, a related issue to CVE-2012-0126. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect integrity via vectors related to JMX. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to a missing check for "package access" by the MBeanServer Introspector. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to AWT. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2442 and CVE-2013-2466. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect availability via vectors related to AWT. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue does not "properly manage and restrict certain resources related to the processing of fonts," possibly involving temporary files. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ByteBandedRaster size checks" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect availability via unknown vectors. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 6 Update 27 and earlier, when running on Windows, allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality via vectors related to JMX. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient class access checks" when "creating new instances" using MBeanInstantiator. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "IIOP type reuse management" in ObjectStreamClass.java. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 45 and earlier and 5.0 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-1540. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect integrity via vectors related to JMX. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to a missing check for "package access" by the MBeanServer Introspector. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "integer overflow checks." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion Middleware R27.7.5 and earlier and R28.2.7 and earlier; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June and July 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass verification of XML signatures via vectors related to a "Missing check for [a] valid DOMCanonicalizationMethod canonicalization algorithm." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2440. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running a named process. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-1540. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper checks of "access control context" in the JMX RequiredModelMBean class. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to Networking. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an information leak involving InetAddress serialization. CVE has not investigated the apparent discrepancy between vendor reports regarding the impact of this issue. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2466 and CVE-2013-2468. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "XML security and the class loader." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2433. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion Middleware R27.7.5 and earlier and R28.2.7 and earlier; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June and July 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass verification of XML signatures via vectors related to a "Missing check for [a] valid DOMCanonicalizationMethod canonicalization algorithm." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect availability via unknown vectors related to Serialization. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper handling of circular references in ObjectStreamClass. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2443 and CVE-2013-2452. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect access checks by the (1) getEnclosingClass, (2) getEnclosingMethod, and (3) getEnclosingConstructor methods. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary files via a filename argument in the -sp option to the X program, which produces different error messages depending on whether the filename exists. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, and 6 Update 30 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "checking of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-2432 and CVE-2013-1491. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image layout verification" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the default java.rmi.server.useCodebaseOnly setting of false, which allows remote attackers to perform "dynamic class downloading" and execute arbitrary code. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-1569, CVE-2013-2383, and CVE-2013-2420. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font layout" in the International Components for Unicode (ICU) Layout Engine before 51.2. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in the (1) sid_parse and (2) dom_sid_parse functions in Samba before 3.5.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Windows Security ID (SID) on a file share. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ShortBandedRaster size checks" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Install. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the OS-Core.CORE2-KRN fileset in HP HP-UX B.11.23 and B.11.31 allows local users to cause a denial of service via unknown vectors. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; JavaFX 2.2.7 and earlier; and OpenJDK 6 and 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to ImageIO. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "JPEGImageReader state corruption" when using native code. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Networking. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper enforcement of exclusive port binds when running on Windows, which allows attackers to bind to ports that are already in use. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" that can trigger an integer overflow and memory corruption. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to CORBA. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font processing errors" in the International Components for Unicode (ICU) Layout Engine before 51.2. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to Networking. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an information leak involving InetAddress serialization. CVE has not investigated the apparent discrepancy between vendor reports regarding the impact of this issue. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to cross-site scripting (XSS) in the sun.rmi.transport.proxy CGIHandler class that does not properly handle error messages in a (1) command or (2) port number. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper restriction of com.sun.xml.internal packages and "Better handling of UI elements." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to frame injection in HTML that is generated by Javadoc. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "ImagingLib byte lookup processing." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect availability via unknown vectors related to Hotspot. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "handling of memory allocation errors." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 5.0 Update 45 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Java installer. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE 7 Update 13 and earlier and 6 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-1476 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via certain methods that should not be serialized, aka "missing serialization restriction." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-0441 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via "certain value handler constructors." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAXP. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the public declaration of the loadPropertyFile method in the JAXP FuncSystemProperty class, which allows remote attackers to obtain sensitive information. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" in awt_parseImage.c, which triggers memory corruption. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0428 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0428 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-2432 and CVE-2013-1491. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from a third party that the issue is due to an interaction error in between the JRE plug-in for WebKit-based browsers and the Javascript engine, which allows remote attackers to execute arbitrary code by modifying DOM nodes that contain applet elements in a way that triggers an incorrect reference count and a use after free. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2110. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient clipboard access premission checks." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Libraries. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to interrupt certain threads that should not be interrupted. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0428. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0428 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the 2D component in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-1493. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2442 and CVE-2013-2466. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect availability via vectors related to AWT. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue does not "properly manage and restrict certain resources related to the processing of fonts," possibly involving temporary files. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-0441 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via "certain value handler constructors." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Install. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0428. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality and integrity via vectors related to JDBC. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue does not properly restrict access to certain class packages in the SerialJavaObject class, which allows remote attackers to bypass the Java sandbox. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Networking. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to avoid triggering an exception during the deserialization of invalid InetSocketAddress data. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-0441 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via "certain value handler constructors." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Scripting. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-1540. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2466 and CVE-2013-2468. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Networking. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to avoid triggering an exception during the deserialization of invalid InetSocketAddress data. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue involves the creation of a single PresentationManager that is shared across multiple thread groups, which allows remote attackers to bypass Java sandbox restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" that can trigger an integer overflow and memory corruption. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 45 and earlier and 5.0 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and availability, related to AWT. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE, 7, 6 Update 27 and earlier, and 5.0 Update 31 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deserialization. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect IntegerComponentRaster size checks." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys, which allows remote attackers to conduct a "small subgroup attack" to force the use of weak session keys or obtain sensitive information about the private key. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2443 and CVE-2013-2452. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect access checks by the (1) getEnclosingClass, (2) getEnclosingMethod, and (3) getEnclosingConstructor methods. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P3 allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a long resource record. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAXP. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the public declaration of the loadPropertyFile method in the JAXP FuncSystemProperty class, which allows remote attackers to obtain sensitive information. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" that can trigger an integer overflow and memory corruption. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient clipboard access premission checks." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to cross-site scripting (XSS) in the sun.rmi.transport.proxy CGIHandler class that does not properly handle error messages in a (1) command or (2) port number. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Array index error in the make_table function in unlzh.c in the LZH decompression component in gzip 1.3.5, when running on certain platforms, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GZIP archive that triggers an out-of-bounds write, aka a "stack modification vulnerability." Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2435. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect IntegerComponentRaster size checks." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier; and JavaFX 2.2 and earlier; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality and integrity via vectors related to JDBC. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue does not properly restrict access to certain class packages in the SerialJavaObject class, which allows remote attackers to bypass the Java sandbox. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Networking. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to avoid triggering an exception during the deserialization of invalid InetSocketAddress data. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect availability, related to JAXP. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to CPU consumption in the the SSL/TLS implementation via a large number of ClientHello packets that are not properly handled by (1) ClientHandshaker.java and (2) ServerHandshaker.java. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-2463, CVE-2013-2465, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, and CVE-2013-2473. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font processing errors" in the International Components for Unicode (ICU) Layout Engine before 51.2. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the default java.rmi.server.useCodebaseOnly setting of false, which allows remote attackers to perform "dynamic class downloading" and execute arbitrary code. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38 allows remote attackers to affect confidentiality via vectors related to JMX. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys, which allows remote attackers to conduct a "small subgroup attack" to force the use of weak session keys or obtain sensitive information about the private key. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to insufficient indication of an SSL connection failure by JConsole, related to RMI connection dialog box. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image attribute verification" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The ProcSetEventMask function in difs/events.c in the xfs font server for X.Org X11R6 through X11R6.6 and XFree86 before 3.3.3 calls the SendErrToClient function with a mask value instead of a pointer, which allows local users to cause a denial of service (memory corruption and crash) or obtain potentially sensitive information from memory via a SetEventMask request that triggers an invalid pointer dereference. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper checks of "access control context" in the JMX RequiredModelMBean class. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, and JavaFX 2.0 allows remote attackers to affect confidentiality via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to insufficient "validation of images" in share/native/sun/awt/image/awt_ImageRep.c, possibly involving offsets. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" in awt_parseImage.c, which triggers memory corruption. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient checks for cached results" by the Java Beans MethodFinder, which might allow attackers to access methods that should only be accessible to privileged code. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "ImagingLib byte lookup processing." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue involves the creation of a single PresentationManager that is shared across multiple thread groups, which allows remote attackers to bypass Java sandbox restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-1569, CVE-2013-2383, and CVE-2013-2420. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font layout" in the International Components for Unicode (ICU) Layout Engine before 51.2. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, and JavaFX 2.0 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and integrity via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent attackers to execute arbitrary code via (1) a GetVisualInfo request containing a 32-bit value that is improperly used to calculate an amount of memory for allocation by the EVI extension, or (2) a request containing values related to pixmap size that are improperly used in management of shared memory by the MIT-SHM extension. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier allows remote attackers to affect integrity via unknown vectors related to Networking. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "checking of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "IIOP type reuse management" in ObjectStreamClass.java. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to obtain a socket's local address via vectors involving inconsistencies between Socket.getLocalAddress and InetAddress.getLocalHost. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the 2D component in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-1493. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image layout verification" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "integer overflow checks." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect availability via vectors related to AWT. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue does not "properly manage and restrict certain resources related to the processing of fonts," possibly involving temporary files. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue involves the creation of a single PresentationManager that is shared across multiple thread groups, which allows remote attackers to bypass Java sandbox restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2452 and CVE-2013-2455. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to an incorrect "checking order" within the AccessControlContext class. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect IntegerComponentRaster size checks." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions" in the LogStream.setDefaultStream method. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-1569, CVE-2013-2384, and CVE-2013-2420. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "handling of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect availability via unknown vectors related to Serialization. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper handling of circular references in ObjectStreamClass. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-1476 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via certain methods that should not be serialized, aka "missing serialization restriction." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE 7 update 4 and earlier and 6 update 32 and earlier, and the GlassFish Enterprise Server component in Oracle Sun Products Suite GlassFish Enterprise Server 3.1.1, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Web Container or Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper checks of "access control context" in the JMX RequiredModelMBean class. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to CPU consumption in the the SSL/TLS implementation via a large number of ClientHello packets that are not properly handled by (1) ClientHandshaker.java and (2) ServerHandshaker.java. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Distributed Computing Environment (DCE) 1.8 and 1.9 on HP HP-UX B.11.11 and B.11.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to JMX. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to an incorrect implementation of "certain class checks" that allows remote attackers to bypass intended class restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAXP. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the public declaration of the loadPropertyFile method in the JAXP FuncSystemProperty class, which allows remote attackers to obtain sensitive information. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect integrity via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Serialization. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper access checks for subclasses in the ObjectOutputStream class. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-1476 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via certain methods that should not be serialized, aka "missing serialization restriction." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0428. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to obtain a socket's local address via vectors involving inconsistencies between Socket.getLocalAddress and InetAddress.getLocalHost. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Libraries. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to interrupt certain threads that should not be interrupted. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38 allows remote attackers to affect confidentiality via vectors related to JMX. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "IIOP type reuse management" in ObjectStreamClass.java. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality and integrity via vectors related to JDBC. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue does not properly restrict access to certain class packages in the SerialJavaObject class, which allows remote attackers to bypass the Java sandbox. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2442 and CVE-2013-2468. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2443 and CVE-2013-2455. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "network address handling in virtual machine identifiers" and the lack of "unique and unpredictable IDs" in the java.rmi.dgc.VMID class. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to CPU consumption in the the SSL/TLS implementation via a large number of ClientHello packets that are not properly handled by (1) ClientHandshaker.java and (2) ServerHandshaker.java. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-2463, CVE-2013-2465, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, and CVE-2013-2473. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via vectors related to CORBA. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue does not properly enforce access restrictions for CORBA output streams. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2443 and CVE-2013-2455. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "network address handling in virtual machine identifiers" and the lack of "unique and unpredictable IDs" in the java.rmi.dgc.VMID class. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to ImageIO. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "JPEGImageWriter state corruption" when using native code, which triggers memory corruption. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect availability via unknown vectors related to Hotspot. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "handling of memory allocation errors." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient clipboard access premission checks." Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP NFS/ONCplus B.11.31.10 and earlier on HP-UX B.11.31 allows remote authenticated users to cause a denial of service via unknown vectors. Ganesh Manal DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome, allows remote attackers to bypass the "Very High" security level of the Java Control Panel and execute unsigned Java code without prompting the user via unknown vectors, aka "Issue 53" and the "Java Security Slider" vulnerability. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in (1) X.Org Xserver before 1.4.1, and (2) the libfont and libXfont libraries on some platforms including Sun Solaris, allows context-dependent attackers to execute arbitrary code via a PCF font with a large difference between the last col and first col values in the PCF_BDF_ENCODINGS table. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect availability, related to JSSE. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to cross-site scripting (XSS) in the sun.rmi.transport.proxy CGIHandler class that does not properly handle error messages in a (1) command or (2) port number. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 allows remote attackers to affect confidentiality via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect integrity via unknown vectors related to Deployment. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Scripting. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38 allows remote attackers to affect confidentiality via vectors related to JMX. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to ImageIO. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "JPEGImageWriter state corruption" when using native code, which triggers memory corruption. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper method-invocation restrictions by the MethodUtil trampoline class, which allows remote attackers to bypass the Java sandbox. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper restriction of com.sun.xml.internal packages and "Better handling of UI elements." Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the 2D component in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-1493. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted string data, as demonstrated by the define function in zend_builtin_functions.c, and unspecified functions in ext/soap/php_sdl.c, ext/standard/syslog.c, ext/standard/browscap.c, ext/oci8/oci8.c, ext/com_dotnet/com_typeinfo.c, and main/php_open_temporary_file.c. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from a third party that the issue is due to an interaction error in between the JRE plug-in for WebKit-based browsers and the Javascript engine, which allows remote attackers to execute arbitrary code by modifying DOM nodes that contain applet elements in a way that triggers an incorrect reference count and a use after free. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via vectors related to CORBA. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue does not properly enforce access restrictions for CORBA output streams. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect availability via unknown vectors related to Hotspot. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "handling of memory allocation errors." Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-3744. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys, which allows remote attackers to conduct a "small subgroup attack" to force the use of weak session keys or obtain sensitive information about the private key. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP-UX B.11.31 allows local users to cause a denial of service (system crash) via unknown vectors related to the ttrace system call. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JMX. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier, when running on Solaris, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Networking. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-2394 and CVE-2013-1491. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in NFS / ONCplus B.11.31_04 and earlier on HP-UX B.11.31 allows remote attackers to cause a denial of service via unknown attack vectors. Ganesh Manal DRAFT INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Samba 3.x before 3.3.15, 3.4.x before 3.4.12, and 3.5.x before 3.5.7 does not perform range checks for file descriptors before use of the FD_SET macro, which allows remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening a large number of files, related to (1) Winbind or (2) smbd. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ByteBandedRaster size checks" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message, a different vulnerability than CVE-2006-7250. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-2394 and CVE-2013-1491. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ShortBandedRaster size checks" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" in awt_parseImage.c, which triggers memory corruption. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to AWT. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Buffer overflow in the make_table function in the LHZ component in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted decoding table in a GZIP archive. Ganesh Manal DRAFT Ganesh Manal INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED ACCEPTED HP-UX 11 The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 45 and earlier and 5.0 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ShortBandedRaster size checks" in 2D. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to GnomeFileTypeDetector and a missing check for read permissions for a path. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to obtain a socket's local address via vectors involving inconsistencies between Socket.getLocalAddress and InetAddress.getLocalHost. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Libraries. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to interrupt certain threads that should not be interrupted. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "XML security and the class loader." Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier. Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer." Ganesh Manal DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The wu_fnmatch function in wu_fnmatch.c in wu-ftpd 2.6.1 and 2.6.2 allows remote attackers to cause a denial of service (CPU exhaustion by recursion) via a glob pattern with a large number of * (wildcard) characters, as demonstrated using the dir command. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in su in HP HP-UX B.11.11, when using the LDAP netgroup feature, allows local users to gain unspecified access. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Michael Wood INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 AutoRAID Manager Possible unknown vulnerability or vulnerabilities in HP DiskArray Utilities with AutoRAID Manager. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 /sbin/passwd in HP-UX B.11.00, B.11.11, and B.11.23 before 20060326 "does not recover gracefully from some error conditions," which allows local users to cause a denial of service. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 /sbin/passwd in HP-UX B.11.00, B.11.11, and B.11.23 before 20060326 "does not recover gracefully from some error conditions," which allows local users to cause a denial of service. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 Unknown vulnerability in HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and B.11.23, when running TCP/IP on IPv4, allows remote attackers to cause a denial of service via certain packets, related to the PMTU, a different vulnerability than CVE-2004-1060. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Michael Wood INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 Unknown vulnerability in the login page for HP Systems Insight Manager (SIM) 4.0 and 4.1, when accessed by Microsoft Internet Explorer with the MS04-025 patch, leads to a denial of service (browser hang). NOTE: although the advisory is vague, this issue does not appear to involve an attacker at all. If not, then this issue is not a vulnerability. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in HP HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 remshd Unknown vulnerability in remshd daemon in HP-UX B.11.00, B.11.11, and B.11.23 while running in "Trusted Mode" allows remote attackers to gain unauthorized system access via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 envd daemon in HP-UX B.11.00 through B.11.11 allows local users to obtain privileges via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Michael Wood INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED ACCEPTED HP-UX 11 SecureShell sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unknown vulnerability in HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and B.11.23, when running TCP/IP on IPv4, allows remote attackers to cause a denial of service via certain packets, related to the PMTU, a different vulnerability than CVE-2004-1060. Robert L. Hollis DRAFT INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 SecureShell zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Unknown vulnerability in HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and B.11.23, when running TCP/IP on IPv4, allows remote attackers to cause a denial of service via certain packets, related to the PMTU, a different vulnerability than CVE-2004-1060. Robert L. Hollis DRAFT INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag. Yamini Mohan R DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request. Yamini Mohan R DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request. Yamini Mohan R DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. Yamini Mohan R DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound, a different vulnerability than CVE-2011-0802. Yamini Mohan R DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier allows remote attackers to affect availability via unknown vectors related to NIO. Yamini Mohan R DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to AWT. Yamini Mohan R DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier allows remote attackers to affect confidentiality via unknown vectors related to 2D. Yamini Mohan R DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086. Yamini Mohan R DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd. Yamini Mohan R DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 Multiple integer overflows in vxsvc.exe in the Veritas Enterprise Administrator service in Symantec Veritas Storage Foundation 5.1 and earlier, Veritas Storage Foundation Cluster File System (SFCFS) 5.1 and earlier, Veritas Storage Foundation Cluster File System Enterprise for Oracle RAC (SFCFSORAC) 5.1 and earlier, Veritas Dynamic Multi-Pathing (DMP) 5.1, and NetBackup PureDisk 6.5.x through 6.6.1.x allow remote attackers to execute arbitrary code via (1) a crafted Unicode string, related to the vxveautil.value_binary_unpack function; (2) a crafted ASCII string, related to the vxveautil.value_binary_unpack function; or (3) a crafted value, related to the vxveautil.kv_binary_unpack function, leading to a buffer overflow. Yamini Mohan R DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED Prashant Kumar INTERIM ACCEPTED Mike Cokus INTERIM ACCEPTED ACCEPTED HP-UX 11 The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086. Yamini Mohan R DRAFT INTERIM ACCEPTED Sushant Kumar Singh INTERIM Sushant Kumar Singh ACCEPTED