Windows 7 and Windows Server 2008 R2 October 2017 Security Updates (KRACK)

The remote Windows host is missing security update 4041678 or cumulative update 4041681. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in...

Debian DLA-1126-1 : libxfont security update

It was discovered that there two vulnerabilities the library providing font selection and rasterisation, libxfont : - CVE-2017-13720: If a pattern contained a '?' character any character in the string is skipped even if it was a '\0'. The rest of the matching then read invalid memory. -...

Security vulnerabilities fixed in Thunderbird 52.4 — Mozilla

A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash. A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications ARIA elements...

UBUNTU-CVE-2017-13722

In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check for PCF files could be used by local attackers authenticated to an Xserver for a buffer over-read, for information disclosure or a crash of the X server...

Use-After-Free

ImageMagick is susceptible to a use-after-free vulnerability. The vulnerability exists in the RenderFreetype function of magick/annotate.c. Calling the FTDoneGlyph method at a wrong place in the code allows the attacker to trigger the attack by sending a malicious font file...

DEBIAN-CVE-2017-14989

A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, because the FTDoneGlyph function from FreeType 2 is called at an incorrect place in the ImageMagick code...

Design/Logic Flaw

A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, because the FTDoneGlyph function from FreeType 2 is called at an incorrect place in the ImageMagick code...

DEBIAN-CVE-2017-14976

The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler 0.59.0 has a heap-based buffer over-read vulnerability if an out-of-bounds font dictionary index is encountered, which allows an attacker to launch a denial of service attack...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial...

CVE-2017-14989

A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, because the FTDoneGlyph function from FreeType 2 is called at an incorrect place in the ImageMagick code...

UBUNTU-CVE-2017-14989

A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, because the FTDoneGlyph function from FreeType 2 is called at an incorrect place in the ImageMagick code...

UBUNTU-CVE-2017-14976

The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler 0.59.0 has a heap-based buffer over-read vulnerability if an out-of-bounds font dictionary index is encountered, which allows an attacker to launch a denial of service attack...

CVE-2017-14976

The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler 0.59.0 has a heap-based buffer over-read vulnerability if an out-of-bounds font dictionary index is encountered, which allows an attacker to launch a denial of service attack...

FreeBSD : ImageMagick -- denial of service via a crafted font file (16fb4f83-a2ab-11e7-9c14-009c02a2ab30)

MITRE reports : The ReadCAPTIONImage function in coders/caption.c in ImageMagick allows remote attackers to cause a denial of service infinite loop via a crafted font file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Cross-Site Scripting (XSS)

PhenX/php-font-lib is vulnerable to cross-site scripting XSS attacks. The attacker can inject arbitrary script via the name parameter since it does not encode it properly using the htmlentities method...

Design/Logic Flaw

The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service infinite loop via a crafted font file...

DEBIAN-CVE-2017-14741

The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service infinite loop via a crafted font file...

CVE-2017-14741

The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service infinite loop via a crafted font file...

CVE-2017-14741

The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service infinite loop via a crafted font file...

CVE-2017-14741

CVE-2017-14741: ImageMagick 7.0.7-3 is vulnerable via the ReadCAPTIONImage function in coders/caption.c. A crafted font file can cause a denial of service due to an infinite loop when processing CAPTION-capable images. Affected product/version: ImageMagick 7.0.7-3 (ReadCAPTIONImage). Root cause: ...