CVE-2020-17417

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.35811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-17415

This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PhantomPDF 10.0.0.35798. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

CVE-2020-17416

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-17415

CVE-2020-17415 affects Foxit PhantomPDF (notably the Update Service) where incorrect permissions on a configuration/resource used by the update service allow a local, low-privilege attacker to escalate to SYSTEM and execute code. Affected versions include PhantomPDF 10.0.0.35798 (and related 10.0...

CVE-2020-17413

Foxit PhantomPDF 10.0.0.35798 is affected by CVE-2020-17413 due to a stack-based buffer overflow when parsing U3D objects in PDFs. The root cause is improper validation of the length of user-supplied data before copying to a fixed-length stack buffer, enabling remote code execution with required ...

CVE-2020-17413

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-17412

The CVE-2020-17412 entry concerns Foxit PhantomPDF 10.0.0.35798 with a vulnerability in the handling of U3D objects embedded in PDF files. The issue arises from inadequate validation of user-supplied data, leading to a write past the end of an allocated structure and potential remote code executi...

CVE-2020-17411

CVE-2020-17411 affects Foxit PhantomPDF 10.0.0.35798. The flaw is in handling of U3D objects embedded in PDF files, caused by inadequate validation of user-supplied data, leading to an information-disclosure/out-of-bounds condition (read past end of an allocated object). Exploitation requires use...

CVE-2020-17410

Foxit PhantomPDF 10.0.0.35798 and earlier is affected by a GIF file parsing use-after-free vulnerability. The bug stems from not validating the existence of an object before performing operations, enabling arbitrary code execution in the context of the current process. Exploitation requires user ...

CVE-2020-17406

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE prior to v1.2.0-r1112. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the ping parameter provided to tools.sh. The issu...

CVE-2020-17407

Affected product: Microhard Bullet-LTE (firmware prior to v1.2.0-r1112). Vulnerability summary: A stack-based buffer overflow in the handling of the Basic/authentication headers allows remote attackers to execute arbitrary code with root privileges. The flaw arises from insufficient validation of...

CVE-2020-17406

CVE-2020-17406 affects Microhard Bullet-LTE prior to v1.2.0-r1112. The issue is in the handling of the ping parameter in tools.sh, stemming from improper validation of a user-supplied string before it is used in a system call. This allows an attacker with authentication to execute arbitrary code ...

CVE-2020-17407

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE prior to v1.2.0-r1112. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of authentication headers. The issue results fro...

Unbreakable Enterprise kernel security update

4.1.12-124.43.4 - kvm: fix kvmioctlcreatedevice reference counting CVE-2019-6974 Jann Horn Orabug: 29434845 CVE-2019-6974 - KVM: nVMX: unconditionally cancel preemption timer in freenested CVE-2019-7221 Peter Shier Orabug: 29434898 CVE-2019-7221 - KVM: x86: work around leak of uninitialized stack...

Binary Vulnerability in Shenzhen Xunlei.com Culture Co. Light and Shadow Viewing (CNVD-2020-58845)

Light Viewer is a photo viewing software for the photography and designer crowd, featuring fast viewing, accurate color reproduction of pictures in various color spaces, and so on. A binary vulnerability exists in Shenzhen Xunlei.com Culture Co. An attacker can exploit this vulnerability to cause...

CVE-2020-17408

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the clpwebmc executable. Due to the improper restriction of XML External...

CVE-2020-17408

The connected sources confirm a XXE vulnerability in NEC ExpressCluster (clpwebmc) affecting NEC CLUSTERPRO X/EXPRESSCLUSTER X 4.1/4.2. Root cause: improper restriction of XML External Entity references allows remote attackers to disclose sensitive information via specially crafted XML, in the co...

USN-4485-1 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities

Timothy Michaud discovered that the i915 graphics driver in the Linux kernel did not properly validate user memory locations for the i915gemexecbuffer2ioctl. A local attacker could possibly use this to cause a denial of service or execute arbitrary code. CVE-2018-20669 It was discovered that the...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4485-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4485-1 advisory. Timothy Michaud discovered that the i915 graphics driver in the Linux kernel did not properly validate user memory locations for the...

CVE-2020-17405

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Senstar Symphony 7.3.2.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSOAuth process. The issue results from the lack of proper...