Apple iOS Webkit 'canvas' element image processing information disclosure vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability in Apple iOS Webkit's handling of 'canvas' element images allows attackers to construct malicious WEB pages that can be parsed by tricking users into parsing them, which can acces...

python-django-horizon: persistent XSS in Horizon metadata dashboard

A flaw was discovered in the OpenStack dashboard horizon handling of metadata. Potentially untrusted data was displayed from OpenStack Image service glance images, OpenStack Compute nova flavors, or host aggregates without correct sanitization. The flaw could be used by an authenticated user to...

Hewlett-Packard KeyView IDOL GIF Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard KeyView IDOL. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the handling...

Apple Safari Cross-Domain Image Data Access Vulnerability

Apple Safari is an open source WEB browser. A security vulnerability exists in Apple Safari that allows remote attackers to exploit a vulnerability to construct malicious WEB pages that can be tricked into parsing by the user to access image data across domains...

APPLE-SA-2015-08-13-1 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-08-13-1 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 is now available and addresses the following: Safari Application Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and O...

Design/Logic Flaw

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a...

CVE-2015-3753

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a...

[SECURITY] Fedora 22 Update: dcraw-9.25.0-2.fc22

This package contains dcraw, a command line tool to decode raw image data downloaded from digital cameras...

[SECURITY] Fedora 21 Update: dcraw-9.25.0-2.fc21

This package contains dcraw, a command line tool to decode raw image data downloaded from digital cameras...

openstack-glance: potential resource exhaustion and denial of service using images manipulation API

Multiple flaws were found in the glance task API that could cause untracked image data to be left in the back end. A malicious user could use these flaws to deliberately accumulate untracked image data, and cause a denial of service via resource exhaustion...

openstack-glance: potential resource exhaustion and denial of service using images manipulation API

Multiple flaws were found in the glance task API that could cause untracked image data to be left in the back end. A malicious user could use these flaws to deliberately accumulate untracked image data, and cause a denial of service via resource exhaustion...

Red Hat docker HTTP degradation vulnerability

Docker is an open-source application container engine that allows developers to package their applications, as well as dependency packages, into a portable container that can then be distributed to any popular Linux machine, as well as virtualized. Red Hat docker package with the --add-registry...

CVE-2015-1843

The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position...

WoltLab Community Gallery Cross-Site Scripting Vulnerability

WoltLab Community Gallery is a set of community photo gallery applications for sharing images and experiences in the community by WoltLab Germany. A cross-site scripting vulnerability exists in version 2.0 of WoltLab Community Gallery prior to 2014-12-26, which stems from a failure of the...

CVE-2014-9602

libavcodec/xface.h in FFmpeg before 2.5.2 establishes certain digits and words array dimensions that do not satisfy a required mathematical relationship, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted...

CVE-2014-9602

libavcodec/xface.h in FFmpeg before 2.5.2 establishes certain digits and words array dimensions that do not satisfy a required mathematical relationship, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted...

CVE-2014-5277

Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to...

PYSEC-2014-80

Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to...

CVE-2014-5277

Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to...

PYSEC-2014-80

Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to...