CVE-2017-8785

FastStone Image Viewer 6.2 has a "Data from Faulting Address may be used as a return value" issue. This issue can be triggered by a malformed JPEG 2000 file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS Access Violation or possibly unspecified other impact...

CVE-2017-8785

FastStone Image Viewer 6.2 is affected by a vulnerability in FSViewer.exe triggered by malformed JPEG 2000 files, described as “Data from Faulting Address may be used as a return value.” The issue could allow a DoS (Access Violation) and potentially other impact. The available documents confirm t...

CVE-2017-8420

SWFTools 2013-04-09-1007 on Windows is affected by a DoS vulnerability where a malformed TTF file mishandled by font2swf causes an access violation (Data from Faulting Address controls Branch Selection at image00000000_00400000+0x0000000000003e71). The issue’s root cause is in the font processing...

CVE-2017-8420

Removed by vendor...

CVE-2017-8369

CVE-2017-8369 affects IrfanView 4.44 (32-bit). The vulnerability arises from a Data from Faulting Address that controls branch selection during image viewing/thumbnailing (USER32!wvsprintfA+0x...); this can allow arbitrary code execution via a crafted file. Exploitation is noted as malware exists...

June 27, 2017—KB4022723 (OS Build 14393.1378)

None None...

Friday Squid Blogging: Squids from Space Video Game

An early preview. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

DEBIAN-CVE-2015-9097

The mail gem before 2.5.5 for Ruby aka A Really Ruby Mail Library is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring...

CVE-2015-9097

The mail gem before 2.5.5 for Ruby aka A Really Ruby Mail Library is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring...

CVE-2015-9096

CVE-2015-9096 affects Net::SMTP in Ruby prior to 2.4.0, allowing SMTP command injection via CRLF sequences in RCPT TO or MAIL FROM commands, demonstrated around a DATA substring. The vulnerability applies to Ruby’s Net::SMTP implementation and, per the initial description, is fixed in Ruby 2.4.0 ...

teenreads.com XSS vulnerability

Vulnerable URL: http://www.teenreads.com/reviews/prom-nights-from-hell/"--!" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 165191 VIP website status:| No Check teenreads.com SSL...

Mozilla Firefox 'UnbindFromTree' Stack Buffer Overflow Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. Mozilla Firefox suffers from a stack buffer overflow vulnerability. An attacker could exploit this vulnerability to cause the affected application to crash, resulting in a denial of service...

ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587)

An input validation vulnerability was found in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server...

DEBIAN-CVE-2017-7200

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copyfrom' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to...

Reflective cross-site scripting vulnerability in multiple parameters of DuoDuo Rebate System V8.3_UTF8 official version

DuoDuo rebate system is for e-commerce rebate, shopping guide to provide solutions, is the open source PHP rebate site system. DuoDuoRebate.com system V8.3UTF8 official version February 10, 2017 There is a reflective cross-site scripting vulnerability. Due to the code parameter , ddusername...

Deluge Web UI 1.3.13 - Cross-Site Request Forgery

Deluge Web UI 1.3.13 - Cross-Site Request Forgery !-- Remote code execution via CSRF vulnerability in the web UI of Deluge 1.3.13 Kyle Neideck, February 2017 Product ------- Deluge is a BitTorrent client available from http://deluge-torrent.org. Fix --- Fixed in the public source code, but not in...

CVE-2017-5026

Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote attacker to show alerts on a page they don't control via a crafted HTML page...

Universal Radio Hacker: URH

Universal Radio Hacker investigate wireless protocols like a boss The Universal Radio Hacker is a software for investigating unknown wireless protocols. Features include hardware interfaces for common Software Defined Radios easy demodulation of signals assigning participants to keep overview of...

UBUNTU-CVE-2016-10074

The mail transport aka SwiftTransportMailTransport in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted e-mail address in the 1 From, 2 ReturnPath, or 3 Sender...

DEBIAN-CVE-2016-10074

The mail transport aka SwiftTransportMailTransport in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted e-mail address in the 1 From, 2 ReturnPath, or 3 Sender...