CVE-2014-2013
published 2014-03-03CVE-2014-2013: Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via…
PriorityP354high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
14.52%
96.2th percentile
Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| artifex | mupdf | <= 1.3 | — |
| artifex | mupdf | — | — |
| artifex | mupdf | — | — |
| artifex | mupdf | — | — |
| artifex | mupdf | >= 0 < 1.3-2 | 1.3-2 |
| artifex | mupdf | >= 0 < 1.3-2 | 1.3-2 |
| artifex | mupdf | >= 0 < 1.3-2 | 1.3-2 |
| artifex | mupdf | >= 0 < 1.3-2 | 1.3-2 |
| debian | mupdf | < mupdf 1.3-2 (bookworm) | mupdf 1.3-2 (bookworm) |
| eglibc | eglibc | >= 0 < 2.19-0ubuntu6.6 | 2.19-0ubuntu6.6 |
| jenkins | certain_pages_in_monitoring_plugin | — | — |
| jenkins | jenkins_core | — | — |
| jenkins | monitoring_plugin | — | — |
| jenkins | user_of_monitoring_plugin | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q5j7-qx45-7g2c: Stack-based buffer overflow in the xps_parse_color function in xps/xps-common
ghsa_unreviewed·2022-05-14
CVE-2014-2013 [HIGH] CWE-119 GHSA-q5j7-qx45-7g2c: Stack-based buffer overflow in the xps_parse_color function in xps/xps-common
Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element.
OSV
eglibc, glibc vulnerabilities
osv·2015-02-26·CVSS 5.0
CVE-2013-7423 eglibc, glibc vulnerabilities
eglibc, glibc vulnerabilities
Arnaud Le Blanc discovered that the GNU C Library incorrectly handled file
descriptors when resolving DNS queries under high load. This may cause a
denial of service in other applications, or an information leak. This issue
only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
(CVE-2013-7423)
It was discovered that the GNU C Library incorrectly handled receiving a
positive answer while processing the network name when performing DNS
resolution. A remote attacker could use this issue to cause the GNU C
Library to hang, resulting in a denial of service. (CVE-2014-9402)
Joseph Myers discovered that the GNU C Library wscanf function incorrectly
handled memory. A remote attacker could possibly use this issue to cause
the GNU C Library to crash,
OSV
CVE-2014-2013: Stack-based buffer overflow in the xps_parse_color function in xps/xps-common
osv·2014-03-03·CVSS 7.5
CVE-2014-2013 [HIGH] CVE-2014-2013: Stack-based buffer overflow in the xps_parse_color function in xps/xps-common
Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element.
Red Hat
openstack-heat: authenticated information leak in Heat
vendor_redhat·2014-04-23·CVSS 3.5
CVE-2014-3801 [LOW] CWE-200 openstack-heat: authenticated information leak in Heat
openstack-heat: authenticated information leak in Heat
OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list.
It was discovered that a user could temporarily be able to see the URL of a provider template used in another tenant. If the template itself could be accessed, then additional information could be leaked that would otherwise not be visible.
Package: openstack-heat (Red Hat OpenStack Platform 3) - Will not fix
Red Hat
openstack-nova: RBAC policy not properly enforced in Nova EC2 API
vendor_redhat·2014-04-09·CVSS 6.0
CVE-2014-0167 [MEDIUM] CWE-862 openstack-nova: RBAC policy not properly enforced in Nova EC2 API
openstack-nova: RBAC policy not properly enforced in Nova EC2 API
The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.
It was found that RBAC policies were not enforced in certain methods of the OpenStack Compute EC2 (Amazon Elastic Compute Cloud) API. A remote attacker could use this flaw to escalate their privileges beyond the user group they were originally restricted to. Note that only certain setups using non-default RBAC rules for OpenStack Compute were affected.
Red Hat
polkit-qt: insecure calling of polkit
vendor_redhat·2014-03-24·CVSS 7.2
CVE-2014-5033 [HIGH] CWE-362 polkit-qt: insecure calling of polkit
polkit-qt: insecure calling of polkit
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."
It was found that polkit-qt handled authorization requests with PolicyKit via a D-Bus API that is vulnerable to a race condition. A local user could use this flaw to bypass intended PolicyKit authorizations.
Red Hat
php: multiple vulnerabilities in gdImageCrop()
vendor_redhat·2014-02-06·CVSS 6.8
CVE-2014-2020 [MEDIUM] php: multiple vulnerabilities in gdImageCrop()
php: multiple vulnerabilities in gdImageCrop()
ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a different vulnerability than CVE-2013-7226.
Statement: Not vulnerable. This issue did not affect the versions of php or php53 as shipped with Red Hat Enterprise Linux 5 and 6, and the versions of php54-php as shipped with Red Hat Software Collections 1, as they did not include the vulnerable function (it was introduced in PHP 5.5.0).
Package: php (Red Hat Enterprise Linux 4) - Not affected
Package: gd (Red Hat Enterprise Linux 5) - Not affected
BSD
FreeBSD-SA-14:03.openssl: OpenSSL multiple vulnerabilities
bsd_advisories·2014-01-14·CVSS 4.3
CVE-2013-4353 [MEDIUM] FreeBSD-SA-14:03.openssl: OpenSSL multiple vulnerabilities
FreeBSD-SA-14:03.openssl Security Advisory
The FreeBSD Project
Topic: OpenSSL multiple vulnerabilities
Category: contrib
Module: openssl
Announced: 2014-01-14
Affects: FreeBSD 10.0 prior to 10.0-RC5
Corrected: 2014-01-07 20:04:41 UTC (stable/10, 10.0-PRERELEASE)
2014-01-07 20:06:20 UTC (releng/10.0, 10.0-RC5)
2014-01-07 20:06:20 UTC (releng/10.0, 10.0-RC4-p1)
2014-01-07 20:06:20 UTC (releng/10.0, 10.0-RC3-p1)
2014-01-07 20:06:20 UTC (releng/10.0, 10.0-RC2-p1)
2014-01-07 20:06:20 UTC (releng/10.0, 10.0-RC1-p1)
CVE Name: CVE-2013-4353, CVE-2013-6449, CVE-2013-6450
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
FreeBSD includes software from the OpenSSL
Debian
CVE-2014-2013: mupdf - Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c ...
vendor_debian·2014·CVSS 7.5
CVE-2014-2013 [HIGH] CVE-2014-2013: mupdf - Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c ...
Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element.
Scope: local
bookworm: resolved (fixed in 1.3-2)
bullseye: resolved (fixed in 1.3-2)
forky: resolved (fixed in 1.3-2)
sid: resolved (fixed in 1.3-2)
trixie: resolved (fixed in 1.3-2)
No detection rules found.
Exploit-DB
Elipse E3 - HTTP Denial of Service
exploitdb·2014-11-26·CVSS 5.0
CVE-2014-8652 [MEDIUM] Elipse E3 - HTTP Denial of Service
Elipse E3 - HTTP Denial of Service
---
// Exploit Http DoS Request for SCADA ATTACK Elipse 3
// Mauro Risonho de Paula Assumpção aka firebits
// [email protected]
// 29-10-2013 11:42
// Vendor Homepage: http://www.elipse.com.br/port/index.aspx
// Software Link: http://www.elipse.com.br/port/e3.aspx
// Version: 3.x and prior
// Tested on: windows
// CVE : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8652
// NVD : https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8652
// Hard lock Dll crash in Windows 2003 SP2 + 20 requests connections
// exploit in Golang (golang.com) C Google
// compile and execute:
// go build Exploit-Http-DoS-Request-for-SCADA-ATTACK-Elipse3-PoC.go
// chmod +x Exploit-Http-DoS-Request-for-SCADA-ATTACK-Elipse3-PoC.go
// ./Exploit-Http-DoS-Request
Exploit-DB
ManageEngine EventLog Analyzer - Multiple Vulnerabilities (1)
exploitdb·2014-09-01
CVE-2014-6043 ManageEngine EventLog Analyzer - Multiple Vulnerabilities (1)
ManageEngine EventLog Analyzer - Multiple Vulnerabilities (1)
---
Mogwai Security Advisory MSA-2014-01
Title: ManageEngine EventLog Analyzer Multiple Vulnerabilities
Product: ManageEngine EventLog Analyzer
Affected versions: EventLog Analyzer 9.9 (Build 9002) on Windows/Linux
Impact: critical
Remote: yes
Product link: http://www.manageengine.com/products/eventlog/
Reported: 18/04/2013
by: Hans-Martin Muench (Mogwai, IT-Sicherheitsberatung Muench)
Vendor's Description of the Software:
EventLog Analyzer provides the most cost-effective Security Information and
Event Management (SIEM) software on the market. Using this Log Analyzer
software, organizations can automate the entire process of managing terabytes
of machine generated logs by collecting, analyzing, searching, reporting,
and arc
Exploit-DB
VTLS Virtua InfoStation.cgi - SQL Injection
exploitdb·2014-08-26·CVSS 7.5
CVE-2014-2081 [HIGH] VTLS Virtua InfoStation.cgi - SQL Injection
VTLS Virtua InfoStation.cgi - SQL Injection
---
=====[Alligator Security Team - Security Advisory]============================
- VTLS Virtua InfoStation.cgi SQLi - CVE-2014-2081 -
Author: José Tozo
=====[Table of Contents]======================================================
1. Background
2. Detailed description
3. Other contexts & solutions
4. Timeline
5. References
=====[1. Background]============================================================
* Versions affected: VTLS Virtua InfoStation.cgi - All Versions under 2014.X - or 2013.2.X Are Affected
* Release date: 22/08/2014
* Impact: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service
VTLS-Virtua is a full-function library management system, providing management of circul
Exploit-DB
SpagoBI 4.0 - Persistent HTML Script Insertion
exploitdb·2014-03-03·CVSS 4.3
CVE-2013-6233 [MEDIUM] SpagoBI 4.0 - Persistent HTML Script Insertion
SpagoBI 4.0 - Persistent HTML Script Insertion
---
###################################################
01. ### Advisory Information ###
Title: Persistent HTML Script Insertion permits offsite-bound forms
Date published: 2014-03-01
Date of last update: 2014-03-01
Vendors contacted: Engineering Group
Discovered by: Christian Catalano
Severity: Medium
02. ### Vulnerability Information ###
CVE reference: CVE-2013-6233
CVSS v2 Base Score: 4
CVSS v2 Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N)
Component/s: SpagoBI
Class: Input Manipulation
03. ### Introduction ###
SpagoBI[1] is an Open Source Business Intelligence suite, belonging to
the free/open source SpagoWorld initiative, founded and supported by
Engineering Group[2].
It offers a large range of analytical functions, a highly functional
se
Exploit-DB
MuPDF 1.3 - 'xps_parse_color()' Stack Buffer Overflow
exploitdb·2014-01-20
CVE-2014-2013 MuPDF 1.3 - 'xps_parse_color()' Stack Buffer Overflow
MuPDF 1.3 - 'xps_parse_color()' Stack Buffer Overflow
---
0day - MuPDF Stack-based Buffer Overflow in xps_parse_color()
# Date of discovery: 2013-01-26
# Software Links: http://www.mupdf.com/ ; http://en.wikipedia.org/wiki/MuPDF
# Version:
mupdf.exe!xps_parse_path
mupdf.exe!xps_parse_element
mupdf.exe!xps_parse_fixed_page
mupdf.exe!xps_run_page
mupdf.exe!fz_run_page_contents
mupdf.exe!pdfapp_loadpage
void
xps_parse_element(xps_document *doc, const fz_matrix *ctm, const fz_rect
*area, char *base_uri, xps_resource *dict, fz_xml *node )
{
.............
if (!strcmp(fz_xml_tag(node), "Path"))
xps_parse_path(doc, ctm, base_uri, dict, node);
if (!strcmp(fz_xml_tag(node), "Glyphs"))
xps_parse_glyphs(doc, ctm, base_uri, dict, node);
.............
}
In this case, the Path element is parsed via
Bugzilla
CVE-2013-6235 jamonapi: multiple reflected XSS vulnerabilities
bugzilla·2014-01-24·CVSS 4.3
CVE-2013-6235 [MEDIUM] CVE-2013-6235 jamonapi: multiple reflected XSS vulnerabilities
CVE-2013-6235 jamonapi: multiple reflected XSS vulnerabilities
Multiple non-persistent Cross-Site Scripting vulnerabilities have been identified [1] in the JAMon web application. JAMon contains a flaw that allows multiple reflected cross-site scripting (XSS) attacks. This flaw exists because certain pages do not validate input before returning it to users.
This issue is reported to affect version 2.7, and has not yet been fixed upstream.
[1] http://seclists.org/bugtraq/2014/Jan/92
Discussion:
Created jamonapi tracking bugs for this issue:
Affects: fedora-all [bug 1057700]
---
This issue should be of interest to only jamon.war ?
If is so then you can close this bug,
our package don't provides this artifact.
The issues should be related to these files:
exceptions.jsp
jamonadmin.jsp
Bugzilla
CVE-2013-6478 pidgin: DoS when rendering long URLs
bugzilla·2014-01-23·CVSS 4.3
CVE-2013-6478 [MEDIUM] CVE-2013-6478 pidgin: DoS when rendering long URLs
CVE-2013-6478 pidgin: DoS when rendering long URLs
It was found that pidgin crashed when a mouse pointer was hovered over a long URL. libX11 forcefully exits when Pidgin tries to create an exceptionally wide tooltip window.
Acknowledgements:
Red Hat would like to thank the Pidgin project for reporting this issue.
Discussion:
Created attachment 855919
Local copy of patch
---
External References:
http://pidgin.im/news/security/?id=72
---
Created pidgin tracking bugs for this issue:
Affects: fedora-all [bug 1059049]
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
Via RHSA-2014:0139 https://rhn.redhat.com/errata/RHSA-2014-0139.html
---
pidgin-2.10.9-1.fc20 has been pushed to the Fedora 20 stable repository. If pro
Bugzilla
CVE-2014-2013 mupdf: stack-based buffer overflow in xps_parse_color()
bugzilla·2014-01-22·CVSS 7.5
CVE-2014-2013 [HIGH] CVE-2014-2013 mupdf: stack-based buffer overflow in xps_parse_color()
CVE-2014-2013 mupdf: stack-based buffer overflow in xps_parse_color()
A stack-based buffer overflow was found [1] in mupdf's xps_parse_color() function. An attacker could create a specially crafted XPS file that, when opened, could cause mupdf or an application using mupdf to crash.
Upstream bug filed at [2], along with an attached reproducer. Bug is fixed upstream via [3].
[1] http://seclists.org/fulldisclosure/2014/Jan/130
[2] http://bugs.ghostscript.com/show_bug.cgi?id=694957
[3] http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=60dabde18d7fe12b19da8b509bdfee9cc886aafc
Discussion:
Created mupdf tracking bugs for this issue:
Affects: fedora-all [bug 1056704]
---
mupdf-1.1-5.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note o
Bugzilla
CVE-2013-5904 Oracle JDK: unspecified vulnerability fixed in 7u51 (Deployment)
bugzilla·2014-01-15·CVSS 6.8
CVE-2013-5904 [MEDIUM] CVE-2013-5904 Oracle JDK: unspecified vulnerability fixed in 7u51 (Deployment)
CVE-2013-5904 Oracle JDK: unspecified vulnerability fixed in 7u51 (Deployment)
Oracle Java SE 7u51 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5904). Upstream has CVSSv2 scored this issue as: 6.8/AV:N/AC:M/Au:N/C:P/I:P/A:P
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
Discussion:
This issue has been addressed in following products:
Supplementary for Red Hat Enterprise Linux 5
Supplementary for Red Hat Enterprise Linux 6
Via RHSA-2014:0030 https://rhn.redhat.com/errata/RHSA-2014-0030.html
Bugzilla
CVE-2013-7284 perl-PlRPC: pre-auth remote code execution
bugzilla·2014-01-09·CVSS 6.8
CVE-2013-7284 [MEDIUM] CVE-2013-7284 perl-PlRPC: pre-auth remote code execution
CVE-2013-7284 perl-PlRPC: pre-auth remote code execution
PlRPC is a Perl module that implements IDL-free RPCs. It is intended for cross-domain applications, but it fails to achieve that goal because it uses Storable, which is known to be insecure when deserializing (thawing) untrusted data. User name and password are transmitted using Storable, so code execution can happen before authentication.
The patches that exist just document the issues and are not real fixes.
References:
http://seclists.org/oss-sec/2014/q1/56
https://rt.cpan.org/Public/Bug/Display.html?id=90474
Commit/Patch:
http://pkgs.fedoraproject.org/cgit/perl-PlRPC.git/commit/?id=b9497b8d780a54ff5be6661c5f24d70135e0bb79
Discussion:
Created perl-PlRPC tracking bugs for this issue:
Affects: fedora-all [bug 1051110]
---
T
Bugzilla
CVE-2013-6383 Kernel: AACRAID Driver compat IOCTL missing capability check
bugzilla·2013-11-22·CVSS 6.9
CVE-2013-6383 [MEDIUM] CVE-2013-6383 Kernel: AACRAID Driver compat IOCTL missing capability check
CVE-2013-6383 Kernel: AACRAID Driver compat IOCTL missing capability check
Linux kernel built with the Adaptec RAID controller support(CONFIG_SCSI_AACRAID)
along with the compat mode(CONFIG_COMPAT), is vulnerable due to a missing
capability check in a compat ioctl routine. This could lead to undue usage of
restricted operations by users.
A user/program could use this flaw to perform protected operations via compat
ioctl route.
Upstream fix:
-> https://git.kernel.org/linus/f856567b930dfcdbc3323261bf77240ccdde01f5
Reference:
-> https://secunia.com/advisories/55562/
Discussion:
Statement:
(none)
---
This issue has been addressed in following products:
MRG for RHEL-6 v.2
Via RHSA-2014:0100 https://rhn.redhat.com/errata/RHSA-2014-0100.html
---
This issue has been addressed in follo
Bugzilla
CVE-2013-1557 OpenJDK: LogStream.setDefaultStream() missing security restrictions (RMI, 8001329)
bugzilla·2013-04-16·CVSS 10.0
CVE-2013-1557 [CRITICAL] CVE-2013-1557 OpenJDK: LogStream.setDefaultStream() missing security restrictions (RMI, 8001329)
CVE-2013-1557 OpenJDK: LogStream.setDefaultStream() missing security restrictions (RMI, 8001329)
It was discovered that LogStream.setDefaultStream() is missing security restrictions. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Fixed in Oracle Java SE 7u21 and 6u45.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2013:0752 https://rhn.redhat.com/errata/RHSA-2013-0752.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:0751 https://rhn.redhat.com/errata/RHSA-2013-0751.html
---
OpenJDK7 up
Bugzilla
CVE-2013-2415 OpenJDK: temporary files created with insecure permissions (JAX-WS, 8003542)
bugzilla·2013-04-15·CVSS 2.1
CVE-2013-2415 [LOW] CVE-2013-2415 OpenJDK: temporary files created with insecure permissions (JAX-WS, 8003542)
CVE-2013-2415 OpenJDK: temporary files created with insecure permissions (JAX-WS, 8003542)
It was discovered that JAX-WS could possibly create temporary files with insecure permissions. A local attacker could use this flaw to access temporary files created by an application using JAX-WS.
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Fixed in Oracle Java SE 7u21.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2013:0752 https://rhn.redhat.com/errata/RHSA-2013-0752.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:0751 https://rhn.redhat.com/errata/RHSA-2013-0751.html
---
OpenJDK7 upstream re
Bugzilla
CVE-2013-0401 OpenJDK: sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader (CanSecWest 2013, AWT, 8009305)
bugzilla·2013-03-11·CVSS 10.0
CVE-2013-0401 [CRITICAL] CVE-2013-0401 OpenJDK: sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader (CanSecWest 2013, AWT, 8009305)
CVE-2013-0401 OpenJDK: sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader (CanSecWest 2013, AWT, 8009305)
The sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly
invoke the system class loader. An untrusted Java application or applet
could possibly use this flaw to bypass certain Java sandbox restrictions.
References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0401
[2] http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157
[3] http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/
[4] https://twitter.com/thezdi/status/309784608508100608
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928
http://bugs.ghostscript.com/show_bug.cgi?id=694957http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=60dabde18d7fe12b19da8b509bdfee9cc886aafchttp://lists.opensuse.org/opensuse-updates/2014-02/msg00088.htmlhttp://seclists.org/fulldisclosure/2014/Jan/130http://seclists.org/oss-sec/2014/q1/375http://secunia.com/advisories/58904http://www.debian.org/security/2014/dsa-2951http://www.exploit-db.com/exploits/31090http://www.hdwsec.fr/blog/mupdf.htmlhttp://www.osvdb.org/102340http://www.securityfocus.com/bid/65036http://bugs.ghostscript.com/show_bug.cgi?id=694957http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=60dabde18d7fe12b19da8b509bdfee9cc886aafchttp://lists.opensuse.org/opensuse-updates/2014-02/msg00088.htmlhttp://seclists.org/fulldisclosure/2014/Jan/130http://seclists.org/oss-sec/2014/q1/375http://secunia.com/advisories/58904http://www.debian.org/security/2014/dsa-2951http://www.exploit-db.com/exploits/31090http://www.hdwsec.fr/blog/mupdf.htmlhttp://www.osvdb.org/102340http://www.securityfocus.com/bid/65036
2014-03-03
Published