1392 matches found
AlmaLinux 9.2 [TuxCare] Security Update: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752246531)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752246531 advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affecte...
CentOS Linux 7 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1788346723)
The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1788346723 advisory. - Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31,...
CentOS Linux 7 [TuxCare] Security Update: java-11-openjdk / java-11-openjdk-debug / java-11-openjdk-demo / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1786706544)
The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1786706544 advisory. - Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31,...
Rocky Linux 8 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_0161)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20220161 advisory. OpenJDK: Incomplete deserialization class filtering in ObjectInputStream Serialization, 8264934 CVE-2022-21248 OpenJDK: Incorrect reading of TIFF files in...
CentOS Linux 8.5 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1785152373)
The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1785152373 advisory. - Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the...
CentOS Linux 8.4 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1785152037)
The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1785152037 advisory. - Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the...
CentOS Linux 6 [TuxCare] Security Update: java-1.7.0-openjdk / java-1.7.0-openjdk-demo / etc (CENTOS6:CLSA-2026:1790152236)
The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1790152236 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO...
Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201
Glass Cage: iOS 18.2.1向けゼロクリックPNGエクスプロイトチェーン CVE-2025-43300: ImageIOにおけるO.o.B書き込み CVE-2025-24201: WebKitリモートコード実行 CVE-2025-24085: Core Media権限昇格 パッチ適用: 2025年1月～3月 テスト環境: iPhone 14 Pro Max iOS 18.2.1 VirusTotal分析（検証済みハッシュ） 概要 Glass Cage は、iOS 18.2.1を標的とした重大なゼロクリックPNGベースのエクスプロイトチェーンであり、実環境で...
exr-imageio-poc
exr-imageio-poc iOS/macOS 26.5에서 패치된 ImageIO의 정수 오버플로 취약점에 대한 PoC CVE-2026-28990 버그 발견: Jiri Ha & Arni Hardarson 취약점 iOS/macOS 26.5 이전 버전의 EXRReadPlugin::decodeBlockAppleEXR 함수에서 버퍼 크기를 계산할 때 정수 오버플로가 발생했습니다. 제공된 이미지의 width와 height 값을 곱할 때 랩어라운드wrap-around되어 0이 되도록 하면, 이후 아주 작은 크기로...
zero-click-exploit-analysis
제로클릭, 오래된 트릭 2025년 WhatsApp/ImageIO 제로클릭 익스플로잇 체인의 해부 CVE-2025-55177 + CVE-2025-43300. 연구 논문 및 CVE 연습, 패치 차이점, 직접 해보는 힙/스택 실습이 포함된 대화형 웹 컴패니언. 라이브 사이트: https://mcs.danielwagner.ro 논문 PDF: write-primitive-exploits-ios-to-linux-root.pdf 발표 슬라이드: https://mcs.danielwagner.ro/slides Manim Community 덱,...
CVE-2022-26711
CVE-2022-26711: Apple ImageIO WebP 정수 오버플로우 Apple의 ImageIO 프레임워크에서 WebP 이미지를 파싱할 때 발생하는 정수 오버플로우 취약점으로, 경계를 벗어난 메모리 접근으로 이어집니다. 전체 분석 보고서 - 디스어셈블리 워크스루를 포함한 상세한 근본 원인 분석 개요 비정상적인 WebP 이미지를 처리할 때 행 바이트 계산 중 정수 오버플로우가 발생합니다. 오버플로우로 인해 버퍼가 너무 작게 할당되며, 이후 이미지 디코딩 중에 덮어쓰여집니다. 악의적으로 조작된 WebP 이미지를 처리하면...
CVE-2026-28956-jxl-messages-surface
JPEG XLはiOS Messagesプレビューパスで自動デコードされる CVE-2026-28956（AppleJPEGXL）に関する配信サーフェスの発見、パッチ差分の帰属、および公開PoCの信頼性に関する現実的な検証。 要約 — 従来の通説（およびEXRを用いた我々自身の先行測定）では、iOS MessagesはJPEG/PNG/HEIC以外の添付ファイルをデコードせずに汎用ファイルブロブとしてレンダリングするとされていました。JPEG XLはその前提を覆します：.jxl添付ファイルはMessagesプレビューパスでデコーダに渡されます...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: ImageIO. The supported versions affected include Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. This easily exploitable vulnerabili...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: ImageIO. The supported versions affected include Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. This easily exploitable vulnerability allows an...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO. The supported versions affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. This easily exploitable vulnerability allows an unauthenticat...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: ImageIO. The supported versions affected include Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. This easily exploitable vulnerability allows an...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: ImageIO. The supported versions affected include Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. This easily exploitable vulnerabili...
Exploit for Out-of-bounds Read in Apple Ipados
JPEG XL auto-decodes in the iOS Messages preview path A deliv...
USN-8695-1: CRaC JDK 25 vulnerabilities
It was discovered that the JSSE component of CRaC JDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of CRaC JDK 25 did not correctly authorize users. A remote...
USN-8694-1: CRaC JDK 21 vulnerabilities
It was discovered that the JSSE component of CRaC JDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of CRaC JDK 21 did not correctly authorize users. A remote...