CVE

Id
62132  
CVE No.
CVE-2013-2185  
Status
Candidate  
Description
** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.  
Phase
Assigned (20130219)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
621706 62132 CVE-2013-2185 MLIST:[oss-security] 20130905 Re: CVE-2013-2185 / Tomcat  View
621707 62132 CVE-2013-2185 URL:http://www.openwall.com/lists/oss-security/2013/09/05/4  View
621708 62132 CVE-2013-2185 MLIST:[oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185  View
621709 62132 CVE-2013-2185 URL:http://openwall.com/lists/oss-security/2014/10/24/12  View
621710 62132 CVE-2013-2185 REDHAT:RHSA-2013:1193  View
621711 62132 CVE-2013-2185 URL:http://rhn.redhat.com/errata/RHSA-2013-1193.html  View
621712 62132 CVE-2013-2185 REDHAT:RHSA-2013:1194  View
621713 62132 CVE-2013-2185 URL:http://rhn.redhat.com/errata/RHSA-2013-1194.html  View
621714 62132 CVE-2013-2185 REDHAT:RHSA-2013:1265  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
23219 JVNDB-2013-004794 Clutter の x11/clutter-device-manager-xi2.c における以前の gnome-shell セッションにアクセスされる脆弱性 Clutter の x11/clutter-device-manager-xi2.c の translate_hierarchy_event 関数は、システムを再開時に、デバイスが "disappeared" 状態である場合、XIQueryDevice エラーを適切に処理しないため、gnome-shell のクラッシュを引き起こされ、古い gnome-shell セッションにアクセスされる脆弱性が存在します。 CVE-2013-2190 62132 2.1 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-004794.html  View