WordPress iOS App Bug Leaked Secret Access Tokens to Third-Party Sites

If you have a "private" blog with WordPress.com and are using its official iOS app to create or edit posts and pages, the secret authentication token for your admin account might have accidentally been leaked to third-party websites. WordPress has recently patched a severe vulnerability in its iO...

[SECURITY] Fedora 29 Update: edk2-20190308stable-1.fc29

EDK II is a development code base for creating UEFI drivers, applications and firmware images...

Fedora Update for libjpeg-turbo FEDORA-2019-87e2fa8e0f

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Android Security Bulletin—April 2019Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2019-04-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

[SECURITY] Fedora 30 Update: edk2-20190308stable-1.fc30

EDK II is a development code base for creating UEFI drivers, applications and firmware images...

[SECURITY] Fedora 28 Update: libjpeg-turbo-1.5.3-7.fc28

The libjpeg-turbo package contains a library of functions for manipulating JPEG images...

The vulnerability of the microprogramming software of the Dasan GPON router, related to deficiencies in authentication procedures, allows a hacker to gain full control over the device.

The vulnerability of the microprogramming software of the Dasan GPON router is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the device by adding “?images/” to the URL in the browse...

USN-3925-1 freeimage vulnerability

It was discovered that an out-of-bounds write vulnerability existed in the XMP image handling functionality of the FreeImage library. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could overwrite arbitrary memory, resulting in code execution...

PT-2019-4931 · Imagemagick +1 · Imagemagick +1

Name of the Vulnerable Software and Affected Versions: ImageMagick version 7.0.8-36 Q16 Description: The issue is related to a memory leak in the SVGKeyValuePairs function of coders/svg.c, which can be exploited by an attacker to cause a denial of service via a crafted image file. This is due to...

openSUSE Security Update : xen (openSUSE-2019-418) (Meltdown) (Spectre)

This update for xen to version 4.10.1 fixes several issues bsc1027519. These security issues were fixed : - CVE-2018-3639: Prevent attackers with local user access from extracting information via a side-channel analysis, aka Speculative Store Bypass SSB, Variant 4 bsc1092631. -...

Mozilla Firefox Same Origin Policy Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 66. An attacker can exploit the vulnerability to bypass the same-origin policy and read cross-origin images...

Ubuntu 16.04 LTS : GDK-PixBuf vulnerability (USN-3912-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3912-1 advisory. It was discovered that the GDK-PixBuf library did not properly handle certain BMP images. If an user or automated system were tricked into opening a specially...

Ubuntu: Security Advisory (USN-3912-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-20647

PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory...

USN-3912-1 gdk-pixbuf vulnerability

It was discovered that the GDK-PixBuf library did not properly handle certain BMP images. If an user or automated system were tricked into opening a specially crafted BMP file, a remote attacker could use this flaw to cause GDK-PixBuf to crash, resulting in a denial of service, or possibly execut...

CVE-2019-9797

Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox 66...

Azure Linux Agent Information Disclosure Vulnerability

An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks. An authenticated attacker who successfully exploited this vulnerability could view data in swap that is normally hidden. None of the Azure endorsed distros are vulnerable to this iss...

CVE-2019-6601

CVE-2019-6601 affects BIG-IP AAM: the wamd process fails to drop group permissions when running helper scripts for image/PDF processing. Affected: BIG-IP AAM across versions 11.5.1–11.5.8, 11.6.1–11.6.3.2, 12.1.0–12.1.3.7, and 13.0.0. Root cause: insufficient permission dropping in wamd. Impact: ...

CVE-2019-6601

In BIG-IP 13.0.0, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, the Application Acceleration Manager AAM wamd process used in processing of images and PDFs fails to drop group permissions when executing helper scripts...

PT-2019-18183 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 11.5.1 through 11.5.8 BIG-IP versions 11.6.1 through 11.6.3.2 BIG-IP versions 12.1.0 through 12.1.3.7 BIG-IP version 13.0.0 Description: The Application Acceleration Manager AAM wamd process in BIG-IP fails to drop group...