PT-2019-5884 · Libtiff +8 · Libtiff +8

Name of the Vulnerable Software and Affected Versions: LibTIFF versions 4.0.10 and earlier GDAL versions 3.0.1 and earlier Description: The issue is related to an integer overflow in the tif getimage.c component of the LibTIFF library, potentially causing a heap-based buffer overflow via a crafte...

[SECURITY] Fedora 30 Update: jhead-3.03-4.fc30

Jhead displays and manipulates the non-image portions of EXIF formatted JPEG images, such as the images produced by most digital cameras...

Cisco Enterprise NFV Infrastructure Software Web Management Interface Authentication Bypass Vulnerability

Cisco Enterprise NFV Infrastructure Software is a lightweight virtualization platform that integrates complete VM lifecycle management, monitoring, device programmability, and service chaining in one installable package. An authentication bypass vulnerability exists in the web-based management...

Binance KYC Data Leak — Crypto Exchange Sets $290,000 Bounty On Blackmailer

Malta-based cryptocurrency exchange Binance has become a victim of a ransom demand from a scammer who claimed to have hacked the KYC Know Your Customer data of thousands of its customers. The unknown attacker threatened the world's largest cryptocurrency exchange by volume to release KYC...

Binance KYC Data Leak — Crypto Exchange Sets $290,000 Bounty On Blackmailer

Malta-based cryptocurrency exchange Binance has become a victim of a ransom demand from a scammer who claimed to have hacked the KYC Know Your Customer data of thousands of its customers. The unknown attacker threatened the world's largest cryptocurrency exchange by volume to release KYC...

Moderate: Red Hat Security Advisory: libjpeg-turbo security update

An update for libjpeg-turbo is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

libtiff: Two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c

A vulnerability was found in LibTIFF, where an out-of-bounds write in the cpTags function in tools/tiff2bw.c and tools/pal2rgb.c could lead to a denial of service., anattacker could exploit this flaw by convincing a victim to open a specially crafted file, potentially causing the application to...

exempi: Heap-based buffer overflow in PSD_MetaHandler::CacheFileData function in XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp allows for denial of service via crafted XLS file

An integer wraparound, leading to a buffer overflow, was found in Exempi in the way it handles Adobe Photoshop Images. An attacker could exploit this to cause a denial of service via a crafted image file...

kernel: NULL pointer dereference in fs/xfs/libxfs/xfs_inode_buf.c

An issue was discovered in the XFS filesystem in fs/xfs/libxfs/xfsinodebuf.c in the Linux kernel. A denial of service due to the NULL pointer dereference can occur for a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork...

Buffer Over-read

libexiv2.so is vulnerable to buffer over-read. The function RafImage::readMetadata in rafimage.cpp ignores the buffer size when reading metadata of raf images which can lead to an out-of-bounds read...

CVE-2016-10822

cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images SEC-88...

CVE-2016-10822

cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images SEC-88...

CVE-2018-20906

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction SEC-430...

Information disclosure

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction SEC-430...

CVE-2018-20906

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction SEC-430...

WDExtract - Extract Windows Defender Database From Vdm Files And Unpack It

ExtractWindows Defender database from vdm files and unpack it This program distributed as-is, without any warranty; No official support, if you like this tool, feel free to contribute. Features Unpack VDM containers of Windows Defender/Microsoft Security Essentials; Decrypt VDM container embedded...

Wanted: Cybersecurity Imagery

Eli Sugarman of the Hewlettt Foundation laments about the sorry state of cybersecurity imagery: The state of cybersecurity imagery is, in a word, abysmal. A simple Google Image search for the term proves the point: It's all white men in hoodies hovering menacingly over keyboards, green...

Rare Steganography Hack Can Compromise Fully Patched Websites

An unusual steganographic technique that an attacker can use to implant a malicious webshell on unsuspecting websites has been spotted in Latin America. According to research from Trustwave shared exclusively with Threatpost, a forensic investigation showed that an adversary is implanting PHP cod...

Code injection

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public...

WordPress Adaptive Images for WordPress plugin <= 0.6.66 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability found by Mark Gruffer in WordPress Adaptive Images for WordPress plugin versions = 0.6.66. Solution Update the WordPress Adaptive Images for WordPress plugin to the latest available version at least 0.6.67...