Apple WebKit Frame::setDocument UXSS Exploit

Apple WebKit suffers from a UXSS via Frame::setDocument. Apple WebKit: UXSS via Frame::setDocument CVE-2017-2365 Here's a snippet of Frame::setDocument. void Frame::setDocumentRefPtr&& newDocument ASSERT!newDocument || newDocument-frame == this; if mdoc && mdoc-pageCacheState !=...

CVE-2017-2365

creationtimestamp| type| source ---|---|--- 2017-02-24 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/41453...

Apple WebKit: UXSS via Frame::setDocument (CVE-2017-2365)

Here's a snippet of Frame::setDocument. void Frame::setDocumentRefPtr&& newDocument ASSERT!newDocument || newDocument-frame == this; if mdoc && mdoc-pageCacheState != Document::InPageCache mdoc-prepareForDestruction; mdoc = newDocument.copyRef; ... Before setting |mdoc| to |newDocument|, it calls...

CVE-2017-2365

CVE-2017-2365 affects Apple WebKit components across iOS (pre-10.2.1), Safari (pre-10.0.3), and tvOS (pre-10.1.1). The issue enables cross-origin data exfiltration via crafted web content and is described in Apple’s security content for iOS 10.2.1 and tvOS 10.1.1. Apple indicates patches exist in...

CVE-2016-2365

A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger th...

CVE-2016-2365

A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger th...

CVE-2016-2365

CVE-2016-2365 describes a denial-of-service in Pidgin via the MXIT protocol. The vulnerability stems from how specially crafted MXIT data is processed, potentially causing a null pointer dereference and a crash when received from a malicious server or via network interception. Affected software: ...

[SECURITY] [DSA 3620-1] pidgin security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3620-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 15, 2016 https://www.debian.org/security/faq -...

Debian DLA-542-1 : pidgin security update

Numerous security issues have been identified and fixed in Pidgin in Debian/Wheezy. CVE-2016-2365 MXIT Markup Command Denial of Service Vulnerability CVE-2016-2366 MXIT Table Command Denial of Service Vulnerability CVE-2016-2367 MXIT Avatar Length Memory Disclosure Vulnerability CVE-2016-2368 MXI...

[SECURITY] [DLA 542-1] pidgin security update

Package : pidgin Version : 2.10.10-1deb7u2 CVE ID : CVE-2016-2365 CVE-2016-2366 CVE-2016-2367 CVE-2016-2368 CVE-2016-2369 CVE-2016-2370 CVE-2016-2371 CVE-2016-2372 CVE-2016-2373 CVE-2016-2374 CVE-2016-2375 CVE-2016-2376 CVE-2016-2377 CVE-2016-2378 CVE-2016-2380 CVE-2016-4323 Numerous security...

CVE-2016-2365

A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger th...

Oracle: Security Advisory (ELSA-2011-0885)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-2365

creationtimestamp| type| source ---|---|--- 2015-09-22 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/38267...

Microsoft Windows Kernel-Mode Driver Privilege Elevation Vulnerabilities (3070102)

This host is missing an important security update according to Microsoft Bulletin MS15-073. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2015-2365

CVE-2015-2365 affects the Windows kernel component Win32k.sys (kernel-mode driver). A local attacker can gain privileges via a crafted application, leading to privilege escalation on multiple Windows platforms (Server 2003 SP2/R2 SP2, Vista SP2, Server 2008 SP2/R2, 7 SP1, 8/8.1, Server 2012/R2, R...

MS15-073: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (3070102)

The remote Windows host is affected by multiple vulnerabilities : - Multiple privilege escalation vulnerabilities exist in the Windows kernel-mode driver due to improper handling of objects in memory. A local attacker can exploit these vulnerabilities, with a specially crafted application, to...

Microsoft Windows Kernel 'Win32k.sys' CVE-2015-2365 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Avaya CallPilot 4.0 Avaya CallPilot 4.0.1 Avaya CallPilot 5.0 Avaya CallPilot 5.0....

Moodle 2.0.x < 2.0.9 / 2.1.x < 2.1.6 / 2.2.x < 2.2.3 Multiple Vulnerabilities

Binary data 8714.prm...

CVE-2014-2365 Advantech WebAccess Improper Access Control

Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors...

CVE-2014-2365

CVE-2014-2365 affects Advantech WebAccess before 7.2. An improper access control/flaw in WebAccess components allowed a remote attacker (in some docs, authenticated) to create or delete arbitrary files; ZDI notes a remote code execution path via gmicons.asp and file operations, with exploits publ...