UBUNTU-CVE-2017-9144

In ImageMagick 7.0.5-5, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c...

FreeBSD : asterisk -- Memory exhaustion on short SCCP packets (fab87bff-3ce5-11e7-bf9d-001999f8d30b)

The Asterisk project reports : A remote memory exhaustion can be triggered by sending an SCCP packet to Asterisk system with 'chanskinny' enabled that is larger than the length of the SCCP header but smaller than the packet length specified in the header. The loop that reads the rest of the packe...

Google Chrome AnimationController::endAnimationUpdate memory misreference vulnerability

Google Chrome is a web browser developed by Google, Inc.AnimationController::endAnimationUpdate is one of the animation controllers. A memory misreference vulnerability exists in AnimationController::endAnimationUpdate in Google Chrome. An attacker can exploit this vulnerability to cause a denial...

Senate's Use of Signal A Good First Step, Experts Say

On Tuesday the United States Senate made it official and approved the use of encrypted messaging app Signal by staffers. Encryption advocates applauded the measure, but say more needs to be done to protect “civic” infrastructure critical to democracy. “The move to secure communications...

Fatal vulnerability will allow an attacker to bypass Apple's OTR signature verification and steal your iCloud keychain information-vulnerability warning-the black bar safety net

! Background content In the analysis of the iOS platform and sandbox escape about the attack surface when we in the iCloud keychain sync feature of OTR implementation has discovered a serious security vulnerability. iCloud keychain sync feature allows users in a secure manner across the device to...

Dutch Police Seize Another Company that Sells PGP-Encrypted Blackberry Phones

The Dutch police arrested four suspects on Tuesday on suspicion of money laundering and involvement in selling custom encrypted BlackBerry and Android smartphones to criminals. The Dutch National High Tech Crime Unit NHTCU, dedicated team within the Dutch National Police Agency aims to investigat...

Announcement: End-of-life Metasploit 32-bit versions

Rapid7 announced the end of life of Metasploit Pro 32-bit versions for both Windows and Linux operating systems on July 5th, 2017. This announcement applies to all editions: Metasploit Pro, Metasploit Express and Metasploit Community. After this date Metasploit 32-bit platforms will not receive...

IoT Security Testing Methodology

By Deral Heiland IoT - IoT Research Lead Rapid7 Nathan Sevier - Senior Consultant Rapid7 Chris Littlebury - Threat Assessment Manage Rapid7 End-to-end ecosystem methodology When examining IoT technology, the actionable testing focus and methodology is often applied solely to the embedded device...

Strengthening Network Access Security with Multi-Factor Authentication

As technology continues to develop, more and more applications become not just convenient, but necessary. It was less than a decade ago that it was inconceivable we would 'need' to carry a consumer device to access the internet in our pockets. Today, it is essential. The same is true with the...

Microsoft Windows 10 Version 1507 Unsupported Version Detection (deprecated)

This plugin has been replaced by Windows Security-End-of-Life plugins. C Tenable Network Security, Inc. @DEPRECATED@ Deprecated on 2024 Mar 14. Replaced by Windows SEoL plugins. include'compat.inc'; if description scriptid100064; scriptversion"1.10";...

DEBIAN-CVE-2017-7995

Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the getuser function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL...

Threat Outbreak Alert RuleID28827: Email Messages Distributing Malicious Software on May 3, 2017

Medium Alert ID: 53680 First Published: 2017 May 3 15:18 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28827 may contain the following files: Name | Size ...

Null pointer dereference

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and...

DEBIAN-CVE-2017-7895

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and...

UBUNTU-CVE-2017-7895

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and...

CVE-2017-2319

A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious attacker to compromise the systems confidentiality or integrity without authentication, leading to managed systems being compromised or services being denied to authent...

Drupal Closes Access Bypass Vulnerability in Core Engine

A critical vulnerability in the Drupal Core engine was addressed in an update released Wednesday. Drupal engineers are calling it an access bypass vulnerability and said a Drupal-based website is vulnerable only under certain conditions, including whether a site has the RESTful Web Services modul...

Symphony CMS <= 2.6.11 RCE Vulnerability

Symphony CMS is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft Windows Vista Unsupported Installation Detection

Microsoft Windows Vista is running on the remote host. Support for this operating system was ended by Microsoft on April 11th, 2017. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities...

Microsoft Addresses Shadow Brokers Exploits

The Microsoft Security Response Center MSRC has published information on several recently publicized exploit tools which affect various Microsoft products. Users and administrators are reminded that software no longer supported by Microsoft also known as end-of-life EOL software is particularly a...