CVE-2018-18703: Improper Limitation of a Pathname to a Restricted Directory

PhpTpoint Mailing Server Using File Handling 1.0 suffers from multiple Arbitrary File Read vulnerabilities in different sections that allow an attacker to read sensitive files on the system via directory traversal, bypassing the login page, as demonstrated by the Mailserverfilesystem/home.php...

MGASA-2018-0413 Updated busybox packages fix security vulnerability

Unziping a specially crafted zip file results in a computation of an invalid pointer and a crash reading an invalid address CVE-2015-9261...

PHPTPoint Mailing Server Using File Handling 1.0 Arbitrary File Read

Exploit Title: phptpoint Mailing Server Using File Handling 1.0 - Arbitrary File Read Date: 2018-10-25 Exploit Author: Boumediene KADDOUR Unit: Algerie Telecom R&D Unit Vendor Homepage: https://www.phptpoint.com/ Software Link: https://www.phptpoint.com/projects/ignou-mca-projects/ Version: 1.0...

elfutils denial of service vulnerability (CNVD-2018-21505)

elfutils is a collection of utilities and libraries for reading, creating and modifying ELF binaries. A security vulnerability in the 'elfend' function of libelf in elfutils 0.174 and earlier stems from the fact that while eu-size is used to process ar files within ar files, before failing to...

DEBIAN-CVE-2018-18520

An Invalid Memory Address Dereference exists in the function elfend in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handlear in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a...

USN-3786-1 libxkbcommon vulnerabilities

It was discovered that libxkbcommon incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862,...

SUSE-SU-2018:2976-1 Security update for ghostscript

This update for ghostscript to version 9.25 fixes the following issues: These security issues were fixed: - CVE-2018-17183: Remote attackers were be able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code bsc1109105 - CVE-2018-15909: Prevent type...

CVE-2018-17828

Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. dot dot in a zip file, because of the function unzzipcat in the bins/unzzipcat-mem.c file...

CVE-2018-10498

CVE-2018-10498 affects Samsung Email and stems from improper validation in the handling of file:/// URIs, enabling local attackers with low-privilege code execution to read arbitrary files and disclose sensitive information. The issue requires local access and is documented with the ZDI advisory ...

Design/Logic Flaw

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable...

CVE-2018-16542

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking during error handling to crash the interpreter...

CVE-2018-16539

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable...

DEBIAN-CVE-2018-16539

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable...

CVE-2018-16539

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable...

CVE-2018-16539

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable...

CVE-2018-16539

CVE-2018-16539 affects Artifex Ghostscript (prior to 9.24). A crafted PostScript file could bypass access checks in temp file handling, allowing disclosure of files on the system. Multiple advisories (Debian, Red Hat/CentOS, Gentoo, Fedora, IBM PowerKVM, Amazon Linux) document this vulnerability ...

PT-2018-13618

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 9.24 Description The issue allows attackers to disclose contents of files on the system that are otherwise not readable by supplying crafted PostScript files, due to incorrect access checking in temp file...

CVE-2018-16539: Exposure of Sensitive Information to an Unauthorized Actor

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable...

CVE-2018-16413

ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/quantum-private.h PushShortPixel function when called from the coders/psd.c ParseImageResourceBlocks function...

UBUNTU-CVE-2018-16392

Several buffer overflows when handling responses from a TCOS Card in tcosselectfile in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service application crash or possibly have unspecified other impact...