CVE-2014-1766

CVE-2014-1766 affects Microsoft Internet Explorer 9–11. The issue enables remote code execution/memory corruption via a crafted web page, as demonstrated by researchers during Pwn2Own. The public-facing fix is MS14-035 (security update for Internet Explorer), with related patches such as KB296926...

flash-plugin: two flaws leading to code execution (APSB14-09)

Use-after-free vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remo...

CVE-2014-0511

Heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014...

Heap overflow

Heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014...

CVE-2014-0512

Adobe Reader 11.0.06 allows attackers to bypass a PDF sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014...

CVE-2014-0511

Heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014...

CVE-2014-0512

Affected products/versions: Adobe Acrobat/Reader XI 11.0.06 and earlier; XI 11.0.06 specifically cited; prior 10.1.9 and earlier as per the VUPEN advisory. Vulnerability class and root cause: An input validation error in the AcroBroker.exe component when processing local file paths could be explo...

CVE-2014-0506

Technical details about CVE-2014-0506 are not publicly provided in the supplied documents. The sources reference the vulnerability but do not include specifics on impact, affected products beyond Flash Player/AIR, or remediation. Monitor for updates.

CVE-2014-0506

Use-after-free vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remo...

CVE-2014-0511

Heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014...

CVE-2014-0512

Adobe Reader 11.0.06 allows attackers to bypass a PDF sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014...

CVE-2014-0511

CVE-2014-0511 is a heap-based buffer overflow affecting Adobe Reader/Acrobat XI 11.0.06 and earlier (and Acrobat/Reader X 10.1.9 and earlier per advisories). Root cause cited in the VUPEN overview: a heap overflow when processing barcode element fields (width/height) in a PDF, enabling arbitrary ...

CVE-2014-0510

CVE-2014-0510 involves a heap-based buffer overflow in Adobe Flash Player 12.0.0.77 . The issue allows remote code execution and can bypass sandbox protections via unspecified vectors, as demonstrated by researchers during a Pwn2Own/CanSecWest 2014 event. Affected product is Flash Player (version...

CVE-2014-1303

Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014...

CVE-2014-1300

Unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors, as demonstrated by Google during a Pwn4Fun competition at CanSecWest 2014...

Heap overflow

Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014...

Code injection

Unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors, as demonstrated by Google during a Pwn4Fun competition at CanSecWest 2014...

CVE-2014-1300

Unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors, as demonstrated by Google during a Pwn4Fun competition at CanSecWest 2014...

CVE-2014-1300

CVE-2014-1300 refers to an unspecified vulnerability in Apple Safari 7.0.2 on macOS OS X that allows remote code execution with root privileges via unknown vectors. The vulnerability was demonstrated by Google during a CanSecWest 2014 Pwn4Fun contest. The connected documents confirm the affected ...

Browser Bugs, BIOS and Brokers dominate CanSecWest, Pwn2Own

Browsers, brokers and BIOS: you could safely call that triumvirate the past, present and future of security, but you’d be wrong. If last week’s CanSecWest conference, and Pwn2Own and Pwnium contests are indeed a point-in-time snapshot of the technical side of information security, then after last...