CVE-2016-6235

The setupimginfojpg function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause a denial of service segmentation fault via a crafted jpeg file...

CVE-2016-6237

The buildhuffcodes function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause denial of service out-of-bounds write via a crafted jpeg file...

Uber: Chained Bugs to Leak Victim's Uber's FB Oauth Token

The Facebook OAuth application was misconfigured to allow any URL that followed the https://auth.uber.com/login? format to be provided as a redirecturi. By taking advantage of this, @ngalog was able to discover that the nexturl parameter could be added to the redirecturi allowing it to be chained...

Security update for MozillaFirefox (important)

This update for MozillaFirefox to version 51.0.1 fixes security issues and bugs. These security issues were fixed: CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP bmo1325200, boo1021814 CVE-2017-5376: Use-after-free in XSL bmo1311687, boo1021817 CVE-2017-5377: Memory...

Security update for seamonkey (important)

This update for Seamonkey to version 2.46 fixes security issues and bugs. The following vulnerabilities were fixed: - Fix all Gecko related security issues between 43.0.1 and 49.0.2 - CVE-2016-6354: buffer overrun in flex boo990856 The following non-security changes are included: - improve...

openSUSE Security Update : MozillaThunderbird (openSUSE-2017-188)

This update to Mozilla Thunderbird 45.7.0 fixes security issues and bugs. The following security issues from advisory MFSA 2017-03 were fixed boo1021991 In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially...

openSUSE Security Update : seamonkey (openSUSE-2017-189)

This update for SeaMonkey to version 2.46 fixes security issues and bugs. The following vulnerabilities were fixed : - Fix all Gecko related security issues between 43.0.1 and 49.0.2 - CVE-2016-6354: buffer overrun in flex boo990856 The following non-security changes are included : - improve...

OPENSUSE-SU-2017:0357-1 Security update for MozillaThunderbird

This update to Mozilla Thunderbird 45.7.0 fixes security issues and bugs. The following security issues from advisory MFSA 2017-03 were fixed boo1021991 In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially...

OPENSUSE-SU-2017:0354-1 Security update for MozillaThunderbird

This update to Mozilla Thunderbird 45.7.0 fixes security issues and bugs. The following security issues from advisory MFSA 2017-03 were fixed boo1021991 In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially...

SUSE SLES11 Security Update : kernel (SUSE-SU-2017:0333-1)

The SUSE Linux Enterprise 11 SP2 LTSS kernel was updated to receive various security and bugfixes. This is the last planned LTSS kernel update for the SUSE Linux Enterprise Server 11 SP2 LTSS. The following security bugs were fixed : - CVE-2016-10088: The sg implementation in the Linux kernel did...

CVE-2017-5610

wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms...

CVE-2017-5612

Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...

[ASA-201701-39] firefox: multiple issues

Arch Linux Security Advisory ASA-201701-39 ========================================== Severity: Critical Date : 2017-01-29 CVE-ID : CVE-2017-5373 CVE-2017-5374 CVE-2017-5375 CVE-2017-5376 CVE-2017-5377 CVE-2017-5378 CVE-2017-5379 CVE-2017-5380 CVE-2017-5381 CVE-2017-5382 CVE-2017-5383 CVE-2017-53...

SUSE-SU-2017:0302-1 Security update for bash

This update for bash fixes the following issues: - CVE-2016-7543: Local attackers could have executed arbitrary commands via specially crafted SHELLOPTS+PS4 variables. bsc1001299 - CVE-2016-0634: Malicious hostnames could have allowed arbitrary command execution when $HOSTNAME was expanded in the...

SUSE SLED12 / SLES12 Security Update : dbus-1 (SUSE-SU-2017:0292-1)

This update for dbus-1 to version 1.8.22 fixes one security issue and bugs. The following security issue was fixed : - bsc1003898: Do not treat ActivationFailure message received from root-owned systemd name as a format string. The following upstream changes are included : - Change the default...

CVE-2016-10002

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to prob...

CVE-2017-5373

Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird 45.7, Firefox ESR 45.7, and...

Mozilla Firefox ESR 45.x < 45.7 Multiple Vulnerabilities (macOS)

The version of Mozilla Firefox ESR installed on the remote macOS or Mac OS X host is 45.x prior to 45.7. It is, therefore, affected by the following vulnerabilities : - Mozilla developers and community members Christian Holler, Gary Kwong, Andre Bargull, Jan de Mooij, Tom Schuster, and Oriol...

UBUNTU-CVE-2017-5374

Memory safety bugs were reported in Firefox 50.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox 51...

Mozilla Firefox < 51.0 Multiple Vulnerabilities

The version of Mozilla Firefox installed on the remote Windows host is prior to 51.0. It is, therefore, affected by multiple vulnerabilities : - Mozilla developers and community members Christian Holler, Gary Kwong, Andre Bargull, Jan de Mooij, Tom Schuster, and Oriol reported memory safety bugs...