Vulnerability Summary for the Week of March 10, 2014 Please Note: • The vulnerabilities are cattegorized by their level of severity which is either High, Medium or Low. • The !" indentity number is the #ublicly $nown %& given to that #articular vulnerability. Therefore you can search the status of that #articular vulnerability using that %&. • The !'S (Common !ulnerability 'coring System) score is a standard scoring system used to determine the severity of the vulnerability. High Severity Vulnerabilities The Primary Vendor --- Description Date CVSS The CVE Product Published Score Identity adobe ** ,dobe 'hoc$wave Player before -..-.0.10/ 2014-03-14 10.0 CVE-2014-0505 shoc$wave+#layer allows remote attac$ers to e1ecute arbitrary code or cause a denial of service (memory corru#tion) via uns#ecified vectors. a##le ** i#hone+os 2ac$u# in ,##le i3' before 4.1 does not #roperly 2014-03-14 8.8 CVE-2013-5133 restrict symlin$s, which allows remote attac$ers to overwrite files during a restore operation via crafted bac$u# data. a##le ** a##le+tv ore a#ture in ,##le i3' before 4.- and ,##le 2014-03-14 7.8 CVE-2014-1271 T! before 5.1 does not #roperly validate %36it ,P% calls, which allows attac$ers to cause a denial of service (assertion failure and device crash) via a crafted a##. a##le ** a##le+tv The #tm1+get+ioctl function in the ,7M $ernel 2014-03-14 7.2 CVE-2014-1278 in ,##le i3' before 4.- and ,##le T! before 5.1 allows local users to gain #rivileges or cause a denial of service (out*of*bounds memory access and device crash) via a crafted call. a##le ** a##le+tv !ideo Driver in ,##le i3' before 4.1 and ,##le 2014-03-14 7.1 CVE-2014-1280 T! before 5.1 allows remote attac$ers to cause a denial of service (N8LL #ointer dereference and device hang) via a crafted video file with MP"9*: encoding. a##le ** a##le+tv 8'2 Host in ,##le i3' before 4.- and ,##le T! 2014-03-14 7.2 CVE-2014-1287 before 5.1 allows #hysically #roximate attac$ers to e1ecute arbitrary code or cause a denial of service (memory corru#tion) via crafted 8'2 messages. atcom ** netvolution 'QL in<ection vulnerability in ,T OM 2014-03-11 7.5 CVE-2014-2318 Netvolution = allows remote attac$ers to e1ecute arbitrary 'QL commands via the m #arameter. citri1 ** 8ns#ecified vulnerability in itri1 Net'caler 2014-03-11 10.0 CVE-2013-6941 netscaler+a##lication+deli ,##lication &elivery ontroller (,& ) >.3.x very_controller+firmware before >.3*5:.4, -/.0 before -/./*44.5, and -/.1 before -/.-*--?.4 allows users to @brea$out@ of the shell via un$nown vectors. freetype ** freetype 'tac$*based buffer overflow in the 2014-03-12 7.5 CVE-2014-2240 cf.+hintma#+build function in cffAcf.hints.c in BreeType before ..5.3 allows remote attac$ers to cause a denial of service (crash) and #ossibly e1ecute arbitrary code via a large number of stem hints in a font file. google ** chrome 8se*after*free vulnerability in 2014-03-16 7.5 CVE-2014-1700 modulesAs#eechA'#eech'ynthesis.c## in 2lin$, as used in 9oogle hrome before ==.0.140/.1:>, allows remote attac$ers to cause a denial of service or #ossibly have uns#ecified other im#act by leveraging im#roper handling of a certain utterance data structure. google ** chrome 8se*after*free vulnerability in the 2014-03-16 7.5 CVE-2014-1702 &atabaseThread::cleanu#&atabaseThread function in modulesAwebdatabaseA&atabaseThread.c## in the web database im#lementation in 2lin$, as used in 9oogle hrome before ==.0.140/.1:>, allows remote attac$ers to cause a denial of service or #ossibly have uns#ecified other im#act by leveraging im#roper handling of scheduled tas$s during shutdown of a thread. google ** chrome 8se*after*free vulnerability in the 2014-03-16 7.5 CVE-2014-1703 Ceb'oc$etDis#atcherHost::SendOrDrop function in contentAbrowserArenderer+hostAwebsoc$et+dis #atcher+host.cc in the Ceb 'oc$ets im#lementation in 9oogle hrome before ==.0.140/.1:> might allow remote attac$ers to bypass the sandbox #rotection mechanism by leveraging an incorrect deletion in a certain failure case. google ** chrome Multi#le uns#ecified vulnerabilities in 9oogle !? 2014-03-16 10.0 CVE-2014-1704 before =.2=.14.1?, as used in 9oogle hrome before ==./.140/.-:>, allow attac$ers to cause a denial of service or #ossibly have other im#act via un$nown vectors. google ** chrome 9oogle !?, as used in 9oogle hrome before 2014-03-16 7.5 CVE-2014-1705 ==.0.140/.10. on 3' D and Linu1 and before ==.0.140/.10: on Cindows, allows remote attac$ers to cause a denial of service (memory corru#tion) or #ossibly have uns#ecified other im#act via un$nown vectors. google ** chrome+os crosh in 9oogle hrome 3' before ==./.140/.-0. 2014-03-16 7.5 CVE-2014-1706 allows attac$ers to in<ect commands via uns#ecified vectors. google ** chrome+os Directory traversal vulnerability in rosDis$s in 2014-03-16 7.5 CVE-2014-1707 9oogle hrome 3' before ==.0.-40/.10. has uns#ecified im#act and attac$ vectors. google ** chrome+os The boot im#lementation in 9oogle hrome 3' 2014-03-16 10.0 CVE-2014-1708 before ==./.140/.-0. does not #roperly consider file #ersistence, which allows remote attac$ers to e1ecute arbitrary code via uns#ecified vectors. google ** chrome+os The ,syncPi1elTransfers om#letedQuery::End 2014-03-16 7.5 CVE-2014-1710 function in g#uAcommand_bufferAserviceAEuery_manager.c c in 9oogle hrome, as used in 9oogle hrome 3' before ==./.140/.-0., does not chec$ whether a certain #osition is within the bounds of a shared-memory segment, which allows remote attac$ers to cause a denial of service (9P8 command-buffer memory corru#tion) or #ossibly have uns#ecified other im#act via un$nown vectors. google ** chrome+os The 9P8 driver in the $ernel in 9oogle hrome 2014-03-16 7.5 CVE-2014-1711 3' before ==./.140/.-0. allows remote attac$ers to cause a denial of service (out*of*bounds write) or #ossibly have uns#ecified other im#act via un$nown vectors. Medium Severity Vulnerabilities The Primary Description Date Published CVSS The CVE Vendor --- Product Score Identity abeel ** 'QL in<ection vulnerability in edit+event.ph# in 2014-03-11 6.5 CVE-2013-3961 sim#le+#h#+agend 'im#le PHP ,genda before ..2.9 allows remote a authenticated users to e1ecute arbitrary 'QL commands via the eventid #arameter. adobe ** ,dobe Blash Player before --.4.7//.24. and --.?.x 2014-03-12 6.4 CVE-2014-0503 flash+#layer through -..0.x before -../.0.74 on Cindows and 3' D, and before --.2.2/..3:5 on Linu1, allows remote attac$ers to by#ass the 'ame Origin Policy via uns#ecified vectors. adobe ** ,dobe Blash Player before --.4.7//.24. and --.?.x 2014-03-12 5.0 CVE-2014-0504 flash+#layer through -..0.x before -../.0.74 on Cindows and 3' D, and before --.2.2/..3:5 on Linu1, allows attac$ers to read the cli#board via uns#ecified vectors. a$er ** ross*site scri#ting (D'') vulnerability in inde1.ph# 2014-03-11 4.3 CVE-2013-6037 secure+mail_gatew in ,$er 'ecure Mail 9ateway ..5.2 and earlier allows ay remote attac$ers to in<ect arbitrary web scri#t or HTML via the msg+id #arameter. a#ache ** The dav_1ml_get+cdata function in mainAutil.c in 2014-03-18 5.0 CVE-2013-6438 htt#+server the mod_dav module in the ,#ache HTTP 'erver before ..4.? does not #ro#erly remove whites#ace characters from &,T, sections, which allows remote attac$ers to cause a denial of service (daemon crash) via a crafted &,! C7%TE reEuest. a#ache ** struts The Parameters%nterce#tor in ,#ache 'truts before 2014-03-11 5.0 CVE-2014-0094 ..=.15.1 allows remote attac$ers to @mani#ulate@ the lassLoader via the class #arameter, which is #assed to the get lass method. a#ache ** The log+cookie function in mod_log+config.c in the 2014-03-18 5.0 CVE-2014-0098 htt#+server mod_log+config module in the ,#ache HTTP 'erver before ..4.? allows remote attac$ers to cause a denial of service (segmentation fault and daemon crash) via a crafted coo$ie that is not #ro#erly handled during truncation. a##le ** i#hone+os Tele#honyU% Bramewor$ in ,##le i3' 4 before 4.1, 2014-03-14 5.0 CVE-2013-6835 when 'afari is used, does not reEuire user confirmation for BaceTime audio calls, which allows remote attac$ers to obtain tele#hone number or e* mail address information via a facetime*audio: 87L. a##le ** a##le+tv The onfiguration Profiles com#onent in ,##le i3' 2014-03-14 5.8 CVE-2014-1267 before 4.1 and ,##le T! before 5.- does not #roperly evaluate the e1#iration date of a mobile configuration #rofile, which allows attac$ers to bypass intended access restrictions by using a #rofile after the date has #assed. a##le ** a##le+tv rashHouse6ee#ing in rash 7e#orting in ,##le i3' 2014-03-14 6.3 CVE-2014-1272 before 4.1 and ,##le T! before 5.- allows local users to change arbitrary file #ermissions by leveraging a symlin$. a##le ** a##le+tv dyld in ,##le i3' before 4.1 and ,##le T! before 2014-03-14 5.8 CVE-2014-1273 5.- allows attac$ers to by#ass code*signing reEuirements by leveraging use of te1t*relocation instructions in a dynamic library.