CVE-2021-42525

Adobe Animate CVE-2021-42525 describes an out-of-bounds read in SVG parsing affecting 21.0.9 and earlier, enabling information disclosure of memory and the bypass of ASLR. Exploitation requires user interaction (victim opens a malicious file). Malware rumors in connected records confirm this clas...

CVE-2021-42525: Out-of-bounds Read

Acrobat Animate versions 21.0.9 and earlieris affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim...

PT-2021-21527

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw was found in the Linux kernel's memory deduplication mechanism. This issue can be exploited via a local mechanism, and the same technique can be used if an attacker can upload...

Randori discovered Zero-day in Palo Alto’s GlobalProtect Firewall, affecting ~10,000 assets.

Outline Palo Alto Networks PAN released an update on November 10, 2021, that patched CVE-2021-3064, which was discovered and disclosed by Randori. This vulnerability affects PAN firewalls that use the GlobalProtect Portal VPN, and it allows for unauthenticated remote code execution on susceptible...

A zero-day vulnerability has been discovered in PAN’s GlobalProtect firewall

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here. Palo Alto Networks PAN released an update on November 10, 2021, that patched CVE-2021-3064, which was discovered and disclosed by Randori. This vulnerability affects PAN firewalls that use the GlobalProtect Portal VPN, and ...

EulerOS 2.0 SP9 : kernel (EulerOS-SA-2021-2688)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypa...

EulerOS 2.0 SP9 : kernel (EulerOS-SA-2021-2713)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypa...

Mozilla Firefox Security Advisory (MFSA2013-11) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Adobe Character Animator 2021 out-of-bounds read vulnerability

Adobe Character Animator is a motion capture and animation tool from Adobe. Adobe Character Animator 2021 4.4 and earlier versions contain an out-of-bounds read vulnerability that can be exploited by attackers to bypass mitigations such as ASLR and cause sensitive memory leaks...

NewStart CGSL CORE 5.05 / MAIN 5.05 : glibc Multiple Vulnerabilities (NS-SA-2021-0180)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has glibc packages installed that are affected by multiple vulnerabilities: - On the x86-64 architecture, the GNU C Library aka glibc before 2.31 fails to ignore the LDPREFERMAP32BITEXEC environment variable during program...

PT-2021-6912

Name of the Vulnerable Software and Affected Versions Acrobat Animate versions 21.0.9 and earlier Description The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as...

PT-2021-6645

Name of the Vulnerable Software and Affected Versions Adobe Character Animator versions 4.4 and earlier Description The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations su...

PT-2021-5166

Name of the Vulnerable Software and Affected Versions Adobe Bridge versions 11.1.2 and earlier Adobe Bridge versions 12.0 and earlier Description The issue is related to an out-of-bounds read vulnerability in Adobe Bridge, which could lead to disclosure of sensitive memory. An attacker could...

PT-2021-5167

Name of the Vulnerable Software and Affected Versions Adobe Bridge versions 11.1.2 and earlier Adobe Bridge versions 12.0 and earlier Description The issue is related to an out-of-bounds read vulnerability in Adobe Bridge that could lead to disclosure of sensitive memory. An attacker could levera...

PT-2021-5168

Name of the Vulnerable Software and Affected Versions Adobe Bridge versions 11.1.2 and earlier Adobe Bridge versions 12.0 and earlier Description The issue is related to an out-of-bounds read vulnerability in Adobe Bridge that could lead to disclosure of sensitive memory. An attacker could levera...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-5116-2)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5116-2 advisory. It was discovered that a race condition existed in the Atheros Ath9k WiFi driver in the Linux kernel. An attacker could possibly use this to...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-5116-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5116-1 advisory. It was discovered that a race condition existed in the Atheros Ath9k WiFi driver in the Linux kernel. An attacker could possibly use this to...

Backdoor.Win32.LanaFTP.k Heap Corruption

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/e2660742a80433e027ee9bdedc40e190.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.LanaFTP.k Vulnerability: Heap Corruption Description: The malware listens on TCP port...

abomonation transmutes &T to and from &[u8] without sufficient constraints

This transmute is at the core of the abomonation crates. It's so easy to use it to violate alignment requirements that no test in the crate's test suite passes under miri. The use of this transmute in serialization/deserialization also incorrectly assumes that the layout of a reprRust type is...

RUSTSEC-2021-0120 abomonation transmutes &T to and from &[u8] without sufficient constraints

This transmute is at the core of the abomonation crates. It's so easy to use it to violate alignment requirements that no test in the crate's test suite passes under miri. The use of this transmute in serialization/deserialization also incorrectly assumes that the layout of a reprRust type is...