MS IE 5/6 OBJECT Tag Same Origin Policy Violation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5196/info Microsoft Internet Explorer allows script code to violate the same origin policy through usage of the HTML OBJECT tag. Malicious script code may obtain a legitimate reference to an embedded object containing a w...

PHP <= 3.0.13 'safe_mode' Failure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/911/info PHP Version 3.0 is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web...

Qualcomm Eudora 5.2.1/6.x Embedded Hyperlink Buffer Overrun Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10298/info Qualcomm Eudora is reported to be prone to a remotely exploitable buffer overrun vulnerability. The issue is exposed when an excessively long hyperlink to a file resource is embedded in an HTML e-mail. This may...

Real Networks RealJukebox 1.0.2/RealOne 6.0.10 Player Gold Skinfile Buffer Overflow

No description provided by source. source: http://www.securityfocus.com/bid/5217/info Real Software has announced a vulnerability in RealJukebox2 and Real Player Gold. A buffer overflow condition exists due to insufficient bounds checking of fields in skinfiles. There is an unchecked buffer for t...

No-IP Dynamic Update Client (DUC) 2.1.9 - Local IP Address Stack Overflow

No description provided by source. !/usr/bin/env python Title: No-IP Dynamic Update Client DUC 2.1.9 local IPaddress stack overflow Author: Alberto Ortega @a0rtega [email protected] Date: May 11 2013 vulnerability discovered Background: No-IP is probably the most used Dynamic DNS provider...

20-Year Old Vulnerability Patched in Compression Algorithm

A 20-year old vulnerability in the Lempel-Ziv-Oberhumer LZO compression algorithm – used in some Android phones, the Linux kernel, and even Mars Rovers – was finally patched this week. Code stemming from the algorithm’s library function has existed in the wild for two decades, but was recycled ov...

20-Year Old Vulnerability in LZO Compression Algorithm Went to Planet Mars

A 20 year old critical subtle integer overflow vulnerability has been discovered in Lempel-Ziv-Oberhumer LZO, an extremely efficient data compression algorithm that focuses on decompression speed, which is almost five times faster than zlib and bzip compression algorithms. Lempel-Ziv-Oberhumer LZ...

mod_wsgi: information leak

modwsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread...

[SECURITY] Fedora 19 Update: polarssl-1.2.10-2.fc19

PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...

Wing FTP Server Authenticated Command Execution

This module exploits the embedded Lua interpreter in the admin web interface for versions 3.0.0 and above. When supplying a specially crafted HTTP POST request an attacker can use os.execute to execute arbitrary system commands on the target with SYSTEM privileges. Module Options msf use...

openSUSE Security Update : filezilla (openSUSE-SU-2013:1347-1)

FileZilla was updated to version 3.7.3 to add various features, fix bugs and also security issues in the embedded putty ssh client. Full changelog: https://filezilla-project.org/changelog.php - Noteworthy changes : - Apply a fix for a security vulnerability in PuTTY as used in FileZilla to handle...

openSUSE Security Update : ghostscript (openSUSE-SU-2012:1289-1)

The following security issue was fixed in ghostscript : Multiple integer underflows in the icmLutallocate function in International Color Consortium ICC Format library icclib, as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service crash...

CVE-2014-2778

Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted embedded font in a 1 .doc or 2 .docx document, aka "Embedded Font Vulnerability."...

Memory corruption

Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted embedded font in a 1 .doc or 2 .docx document, aka "Embedded Font Vulnerability."...

CVE-2014-2778

Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted embedded font in a 1 .doc or 2 .docx document, aka "Embedded Font Vulnerability."...

CVE-2014-2778

CVE-2014-2778 affects Word 2007 SP3 and Office Compatibility Pack SP3. It allows remote attackers to execute arbitrary code or cause a denial of service through a crafted embedded font in a .doc/.docx document due to memory corruption. Affected products include Word 2007 SP3 and Office Compatibil...

Microsoft Office Compatibility Pack Remote Code Execution Vulnerability (2969261)

This host is missing an important security update according to Microsoft Bulletin MS14-034. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Office Word Remote Code Execution Vulnerability (2969261)

This host is missing an important security update according to Microsoft Bulletin MS14-034. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

lcms: insufficient ICC profile version validation (OpenJDK 2D, 8031335)

Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D...

JDK: unspecified vulnerability fixed in 5.0u75, 6u75, 7u55 and 8u5 (2D)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality via unknown vectors related to 2D...