OAuth Worm II - The revenge

We all know about this massive Google Doc Phishing Attack that hit about 1 million accounts right? --- Image from https://arstechnica.com/security/2017/05/dont-trust-oauth-why-the-google-docs-worm-was-so-convincing/ Well this really "sophisticated attack" really?? was based on a really spread...

AntennaHouse DMC HTMLFilter Doc_SetSummary Code Execution Vulnerability

AntennaHouse DMC HTMLFilter DocSetSummary Code Execution Vulnerability Summary An exploitable heap corruption vulnerability exists in the DocSetSummary functionality of AntennaHouse DMC HTMLFilter. A specially crafted doc file can cause a heap corruption resulting in arbitrary code execution. An...

openSUSE Security Update : backintime (openSUSE-2017-525)

This update for backintime to version 1.1.20 fixes several issues. These security issues were fixed : - CVE-2017-7572: The checkPolkitPrivilege function in serviceHelper.py in backintime used a deprecated polkit authorization method unix-process that is subject to a race condition time of check,...

yaml-cpp denial of service vulnerability

yaml-cpp also known as LibYaml-C ++ is a YAML parser. A denial of service vulnerability in the SingleDocParser :: HandleNode function in yaml-cpp version 0.5.3 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted YAML file...

DEBIAN-CVE-2017-5950

The SingleDocParser::HandleNode function in yaml-cpp aka LibYaml-C++ 0.5.3 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted YAML file...

Malware That Targets Both Microsoft, Apple Operating Systems Found

Researchers came across a malicious Word document last week that doesn’t discriminate between OS platforms. The malicious Word document is designed to spread malware on either Mac OS X or Microsoft Windows, depending on where it’s opened. Like many other strains of malware these days, the sample,...

kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2016:2574 An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Threat Outbreak Alert RuleID26067: Email Messages Distributing Malicious Software on November 16, 2016

Medium Alert ID: 49767 First Published: 2016 November 17 15:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID26067 may contain the following files: Name |...

pcre2: Heap-buffer-overflow in parse_regex

Project: svn://vcs.exim.org/pcre2/code/trunk Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6544078783119360 Fuzzer: libFuzzerpcre2fuzzer Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60300000011c Crash State:...

Google Document Embedder < 2.6.2 - CSRF & XSS

The Google Doc Embedder WordPress plugin was affected by a CSRF & XSS security vulnerability...

UBUNTU-CVE-2016-5276

Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird 45.4 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via an...

Google Document Embedder < 2.6.1 - XSS

The Google Doc Embedder WordPress plugin was affected by a XSS security vulnerability...

Mozilla: Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList (MFSA 2016-85, MFSA 2016-86)

Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird 45.4 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via an...

Apache OpenOffice -- multiple vulnerabilities

The Apache Openofffice project reports: CVE-2017-3157: Arbitrary file disclosure in Calc and Writer By exploiting the way OpenOffice renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacke...

Debian DLA-611-1 : jsch security update

It was discovered that there was a path traversal vulnerability in jsch, a pure Java implementation of the SSH2 protocol. For Debian 7 'Wheezy', this issue has been fixed in jsch version 0.1.42-2+deb7u1. We recommend that you upgrade your jsch packages. NOTE: Tenable Network Security has extracte...

pdf to doc converter handle pdf file memory corruption vulnerability

pdf to doc converter is a PDF conversion software. The software suffers from a memory corruption vulnerability in the handling of PDF files that allows an attacker to crash the program by constructing malformed PDF files...

The vulnerability of the Microsoft Word Viewer software for reading doc files allows a hacker to execute arbitrary code.

The vulnerability of the Microsoft Word Viewer for reading doc files arises due to buffer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted Office document...

Microsoft Word 2007/2010/2013/2016 - Out-of-Bounds Read Code Execution (MS16-099)

Application: Microsoft Office Word Platforms: Windows, OSX Versions: Microsoft Office Word 2007,2010,2013,2016 Author: Sébastien Morin of COSIG Website: https://cosig.gouv.qc.ca/en/advisory/ Twitter: @SebMorin1, @COSIG Date: August 09, 2016 CVE: CVE-2016-3313 COSIG-2016-31 1 Introduction 2 Report...

Vulnerabilities in the Debian GNU/Linux operating system that allow a local malicious individual to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the kernel-doc-2.2.19 package of the Debian GNU/Linux operating system may lead to breaches of confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited by local malicious individuals...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the libt1-doc package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...