openSUSE Security Update : gwenview (openSUSE-SU-2010:0691-1)

This update fixes a heap-based overflow in okular. The RLE decompression in the TranscribePalmImageToJPEG function can be exploited to execute arbitrary code with user privileges by providing a crafted PDF file. CVE-2010-2575. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

openSUSE Security Update : python (openSUSE-SU-2014:0380-1)

Python was updated to 2.7.6 to fix bugs and security issues : - bugfix-only release - SSL-related fixes - upstream fix for CVE-2013-4238 - upstream fixes for CVE-2013-1752 - added patches for CVE-2013-1752 bnc856836 issues that are missing in 2.7.6: python-2.7.6-imaplib.patch...

CVE-2014-2133

Buffer overflow in Cisco Advanced Recording Format ARF player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted .arf file that triggers improper LZW...

PYSEC-2014-63

1 cbdecode.py and 2 linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service resource consumption via a large zip archive, which is expanded decompressed...

Internet Bug Bounty: moderate: mod_deflate denial of service

A resource consumption flaw was found in moddeflate. If request body decompression was configured using the "DEFLATE" input filter, a remote attacker could cause the server to consume significant memory and/or CPU resources. The use of request body decompression is not a common configuration...

Apache Httpd < 2.2.29 : mod_deflate denial of service

A resource consumption flaw was found in moddeflate. If request body decompression was configured using the "DEFLATE" input filter, a remote attacker could cause the server to consume significant memory and/or CPU resources. The use of request body decompression is not a common configuration...

Apache Httpd < 2.4.10 : mod_deflate denial of service

A resource consumption flaw was found in moddeflate. If request body decompression was configured using the "DEFLATE" input filter, a remote attacker could cause the server to consume significant memory and/or CPU resources. The use of request body decompression is not a common configuration...

phpcms upload cause getshell detailed and case-vulnerability warning-the black bar safety net

0x01 what is upload vulnerability A lot of cms in order to enrich their functions are to provide the upload an avatar, upload pictures and other functions. But if the uploaded content does not do better than the filter, it is equal to say to the attacker to an arbitrary code execution. For exampl...

GLSA-201311-20 : Okular: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201311-20 Okular: Arbitrary code execution Okular contains a heap-based buffer overflow in the RLE decompression functionality in the TranscribePalmImageToJPEG function in generators/plucker/inplug/image.cpp. Impact : A remote...

Okular: Arbitrary code execution

Background Okular is a universal document viewer based on KPDF for KDE 4. Description Okular contains a heap-based buffer overflow in the RLE decompression functionality in the TranscribePalmImageToJPEG function in generators/plucker/inplug/image.cpp. Impact A remote attacker could entice a user ...

DEBIAN-CVE-2013-4421

The bufdecompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial of service memory consumption via a compressed packet that has a large size when it is decompressed...

ARRIS DG860A NVRAM Backup Compressor / Decompressor

! /usr/bin/env ruby ARRIS DG860A NVRAM Backup 'Compressor/Decompressor', it really does xor? Gleaned from scmix executable in firmware dump. Backup file is world readable without authentication and contains password information in plain text. box:arris-dev cosmo$ wget http://192.168.0.1/router.da...

Zlib decompression error: [-3] | Failed to decompress LZ4 block

Challenge A Backup Job or Restore fails with either of the following errors: Zlib decompression error: -3. or Failed to decompress LZ4 block: Cause When the software reads from a an existing restore point it performs error detection using Cyclic Redundancy Checks CRC to validate the data. The err...

ClamAV multiple security vulnerabilities

Buffer overflow on UPX decompression, array overflow on PDF parsing...

Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication

Early 2012 ESET company a mysterious malware, dubbed the Avatar rootkit Win32/Rootkit.Avatar, advertised in the underground forums by Russian cyber crime. "We present you here previously announced product. In connection with work on other projects, we moved the release date for the public from Ma...

MiniWeb File Upload / Directory Traversal

============================================================================================ Vulnerable Software: MiniWeb build 300, built on Feb 28 2013 Official Site: http://miniweb.sourceforge.net/ Vulns: Remote arbitrary file upload,Directory traversal. Tested Software/version: MiniWeb build...

Microsoft Windows Media Decompression Remote Code Execution Vulnerability (2780091)

This host is missing a critical security update according to Microsoft Bulletin MS13-011. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Windows Media Decompression Remote Code Execution (MS13-011; CVE-2013-0077)

A remote code execution vulnerability has been reported in Microsoft Windows...

MS13-011: Vulnerability in Media Decompression Could Allow Remote Code Execution (2780091)

The remote Windows host is potentially affected by a vulnerability that could allow remote code execution if a user opens a specially crafted media file such as an .mpg file, opens a Microsoft Office document such as a .ppt file that contains a specially crafted embedded media file, or receives...

PHPCMS background business templates at upload SHELL-vulnerability warning-the black bar safety net

The background can directly put the PHP Trojan direct upload. The principle is very simple. Click on the module business template Management Add corporate template. Then add a ZIP compression package. ZIP archive inside a PHP Trojan, back we all understand. Decompression path in the Decompression...