Photon OS 1.0: Krb5 PHSA-2017-0038

An update of the krb5 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0038. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid202838;...

Photon OS 1.0: Git PHSA-2017-0038

An update of the git package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0038. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid202830;...

Important Photon OS Security Update - PHSA-2017-0038

Updates of 'linux', 'linux-esx' packages of Photon OS have been released...

Windows gdi32.dll heap-based out-of-bounds reads / memory disclosure (CVE-2017-0038)

In issue 757, I described multiple bugs related to the handling of DIBs Device Independent Bitmaps embedded in EMF records, as implemented in the user-mode Windows GDI library gdi32.dll. As a quick reminder, the DIB-embedding records follow a common scheme: they include four fields, spots denotin...

Google Discloses Unpatched Microsoft Vulnerability

Google’s security researchers disclosed details of an unpatched Microsoft vulnerability in Windows’ GDI library that allows attackers to steal sensitive data from program memory. The flaw was first addressed by Microsoft last June, but Google said the patch was incomplete. As part of its 90-day...

CVE-2017-0038

The connected material describes a Windows IO Manager bug class (two-step: kernel-mode Initiator sets INPC and IFAC without OFAC; Receiver uses RequestorMode) that can bypass security checks and enable privilege escalation. It clarifies that INPC disables MemAC and SecAC, while OFAC can re-enable...

Microsoft Windows Graphics Component Information Disclosure (MS17-013: CVE-2017-0038)

An information disclosure vulnerability has been reported in Microsoft Windows. The vulnerability is due to the way the Windows GDI component improperly discloses the contents of its memory. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file...

CVE-2017-0038

creationtimestamp| type| source ---|---|--- 2017-02-15 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/41363 2017-03-03 21:33:33+00:00| published-proof-of-concept| https://t.me/canyoupwnme/880 2017-03-03 21:55:35+00:00| published-proof-of-concept| https://t.me/HackerOne/564...

Virtuozzo Linux Errata and Bugfix Advisory 2017:0038

Upstream security update. Follow RHBA-2017-0038 for details...