News Wrap: Microsoft Sway Phish, Malicious GIF and Spyware Attacks

Threatpost editors Tom Spring, Tara Seals and Lindsey O’Donnell-Welch talk about the biggest news stories of the week ended May 1, including: A “PhantomLance” espionage campaign discovered targeting specific Android victims, mainly in Southeast Asia — which could be the work of the OceanLotus APT...

Adobe Bridge GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Bridge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of GIF...

Vulnerability allowed hijacking of Microsoft Teams account with a GIF

By Deeba Ahmed Forget Zoom for a second it is Microsoft Teams service that was exposed to account take over vulnerability with just a GIF file. This is a post from HackRead.com Read the original post: Vulnerability allowed hijacking of Microsoft Teams account with a GIF...

Exploit for Double Free in Whatsapp

WhatsPayloadRCE This is a Automated Generate Payload for CVE-...

Remote Code Execution (RCE)

cups is vulnerable to remote code execution RCE. The attack exists because of LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gifreadlzw function in filter/image-gif.c in CUPS...

Arbitrary Code Execution

openoffice.org is vulnerable to arbitrary code execution. A heap-based buffer overflow flaw, leading to memory corruption, was found in the way OpenOffice.org parsed GIF files. An attacker could create a specially-crafted document, which once opened by a local, unsuspecting user, could cause...

Buffer Overflows

Mozilla Firefox is vulnerable to buffer overflow. A heap-based buffer overflow flaw was found in the Firefox GIF image processor. A malicious GIF image could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Arbitrary Code Execution

java i svulnerable to arbitrary code execution. A buffer overflow flaw was found in how GIF images were processed. A remote attacker could extend privileges to read and write local files, as well as execute local applications with the privileges of the user running the java process...

Arbitrary Code Execution

cups is vulnerable to arbitrary code execution. The vulnerability exists as a buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters "imagetops" and "imagetoraster". An attacker could create a malicious GIF file that could possibly execute arbitrary...

(0Day) Corel PaintShop Pro GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Corel PaintShop Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing...

CVE-2018-19870

An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation fault...

ImageMagick: memory leak in WriteGIFImage function in coders/gif.c

A memory leak vulnerability has been discovered in ImageMagick in the WriteGIFImage function of coders/gif.c file. An attacker could use this flaw to cause a denial of service via a crafted file...

CVE-2020-10963

FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload and consequently Remote Code Execution via admin/tipsimage/image/fileupload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued...

CVE-2020-10963

FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload and consequently Remote Code Execution via admin/tipsimage/image/fileupload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued...

Unrestricted file upload

FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload and consequently Remote Code Execution via admin/tipsimage/image/fileupload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued...

CVE-2020-10963

FrozenNode Laravel-Administrator (up to version 5.0.12) is vulnerable to unrestricted file upload via the admin/tips_image/image/file_upload endpoint, allowing PHP content embedded in a GIF image to be uploaded with a .php extension and potentially execute code remotely. This vulnerability is des...

CVE-2020-10963

FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload and consequently Remote Code Execution via admin/tipsimage/image/fileupload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued...

Adobe Photoshop GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of...

Adobe Bridge CC GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Bridge CC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of GI...

Libnsgif Buffer Overflow Vulnerability (CNVD-2020-16720)

Libnsgif is a decoding library for GIF image file format written in C language. A security vulnerability exists in the 'gifnextLZW' function of the libnsgif.c file in Libnsgif version 0.1.2. An attacker can exploit this vulnerability to cause a denial of service out-of-bounds read and application...