Weekly Vulnerabilities Reports > June 3 to 9, 2013

Overview

4 new vulnerabilities reported during this period, including 1 critical vulnerabilities and 2 high severity vulnerabilities. This weekly summary report vulnerabilities in 1 products from 1 vendors including and Linux. Vulnerabilities are notably categorized as "Resource Exhaustion", "Out-of-bounds Write", "NULL Pointer Dereference", and "Improper Initialization".

  • 3 reported vulnerabilities are remotely exploitables.
  • 3 reported vulnerabilities are exploitable by an anonymous user.
  • Linux has the most reported vulnerabilities, with 4 reported vulnerabilities.
  • Linux has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

1 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2013-06-08 CVE-2011-1180 Linux Out-of-bounds Write vulnerability in Linux Kernel

Multiple stack-based buffer overflows in the iriap_getvaluebyclass_indication function in net/irda/iriap.c in the Linux kernel before 2.6.39 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging connectivity to an IrDA infrared network and sending a large integer value for a (1) name length or (2) attribute length.
9.8

2 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2013-06-08 CVE-2011-4087 Linux Improper Initialization vulnerability in Linux Kernel

The br_parse_ip_options function in net/bridge/br_netfilter.c in the Linux kernel before 2.6.39 does not properly initialize a certain data structure, which allows remote attackers to cause a denial of service by leveraging connectivity to a network interface that uses an Ethernet bridge device.
7.5
2013-06-08 CVE-2011-2482 Linux NULL Pointer Dereference vulnerability in Linux Kernel

A certain Red Hat patch to the sctp_sock_migrate function in net/sctp/socket.c in the Linux kernel before 2.6.21, as used in Red Hat Enterprise Linux (RHEL) 5, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted SCTP packet.
7.5

1 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2013-06-07 CVE-2013-2128 Linux Resource Exhaustion vulnerability in Linux Kernel

The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.
5.5

0 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS