Vulnerabilities > Freedesktop
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2013-04-09 | CVE-2013-1790 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Freedesktop Poppler poppler/Stream.cc in poppler before 0.22.1 allows context-dependent attackers to have an unspecified impact via vectors that trigger a read of uninitialized memory by the CCITTFaxStream::lookChar function. | 6.8 |
| 2013-04-09 | CVE-2013-1789 | Denial of Service vulnerability in Poppler splash/Splash.cc in poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to the (1) Splash::arbitraryTransformMask, (2) Splash::blitMask, and (3) Splash::scaleMaskYuXu functions. network freedesktop | 4.3 |
| 2013-04-09 | CVE-2013-1788 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Freedesktop Poppler poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an "invalid memory access" in (1) splash/Splash.cc, (2) poppler/Function.cc, and (3) poppler/Stream.cc. | 6.8 |
| 2013-03-05 | CVE-2013-0292 | Improper Input Validation vulnerability in Freedesktop Dbus-Glib The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal. | 7.2 |
| 2011-12-10 | CVE-2011-4349 | SQL Injection vulnerability in Freedesktop Colord Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and (a) device id, (b) property, or (c) profile id. | 4.6 |
| 2011-06-22 | CVE-2011-2533 | Link Following vulnerability in Freedesktop Dbus The configure script in D-Bus (aka DBus) 1.2.x before 1.2.28 allows local users to overwrite arbitrary files via a symlink attack on an unspecified file in /tmp/. | 3.3 |
| 2011-02-19 | CVE-2011-1000 | Improper Input Validation vulnerability in Freedesktop Telepathy Gabble jingle-factory.c in Telepathy Gabble 0.11 before 0.11.7, 0.10 before 0.10.5, and 0.8 before 0.8.15 allows remote attackers to sniff audio and video calls via a crafted google:jingleinfo stanza that specifies an alternate server for streamed media. | 6.4 |
| 2010-11-05 | CVE-2010-3702 | Null Pointer Dereference vulnerability in multiple products The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference. network low complexity apple freedesktop xpdfreader fedoraproject opensuse suse debian redhat canonical CWE-476 | 7.5 |
| 2010-08-20 | CVE-2010-1172 | Permissions, Privileges, and Access Controls vulnerability in Freedesktop Dbus-Glib 0.73 DBus-GLib 0.73 disregards the access flag of exported GObject properties, which allows local users to bypass intended access restrictions and possibly cause a denial of service by modifying properties, as demonstrated by properties of the (1) DeviceKit-Power, (2) NetworkManager, and (3) ModemManager services. | 3.6 |
| 2010-04-12 | CVE-2010-1149 | Information Exposure vulnerability in Freedesktop Udisks 1.0 probers/udisks-dm-export.c in udisks before 1.0.1 exports UDISKS_DM_TARGETS_PARAMS information to udev even for a crypt UDISKS_DM_TARGETS_TYPE, which allows local users to discover encryption keys by (1) running a certain udevadm command or (2) reading a certain file under /dev/.udev/db/. | 2.1 |