Trello: Malicious file can be hidden as Card Attachment or Card Cover image

You can upload infected jpeg files to a card. If a user clicks on the attachment image, the infected file will get downloaded instead of showing the image. On opening it, any sort of system calls can be run on the victim. Steps to Reproduce 1 Navigate to https://trello.com/ 2 Click on the Tutoria...

The vulnerability of the console-based graphic editor ImageMagick, which allows a hacker to trigger a service failure

The vulnerability of the ConcatenateImages function in the MagickWand/magick-cli.c console graphic editor for ImageMagick exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure application terminatio...

DEBIAN-CVE-2014-8354

The HorizontalFilter function in resize.c in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service out-of-bounds read via a crafted image file...

Buffer Overflow Arbitrary Code Execution Vulnerability in BMP Image Processing by Greenfish Icon Editor Pro

Greenfish Icon Editor Pro is a powerful icon, cursor, animation and icon library editor. Greenfish Icon Editor Pro suffers from a buffer overflow arbitrary code execution vulnerability when handling BMP images, which can be exploited by an attacker to forge BMP images resulting in arbitrary code...

UBUNTU-CVE-2017-7596

LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted image...

Foxit PhantomPDF Multiple Vulnerabilities (May 2017) - Windows

Foxit PhantomPDF is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:foxitsoftware:phantompdf";...

Foxit Reader Multiple Vulnerabilities (May 2017) - Windows

Foxit Reader is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:foxitsoftware:reader";...

CVE-2017-2416

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "ImageIO" component. It allows remote attackers to execute arbitrary code or cause a denial of...

Sync Breeze v9.5.16 - Buffer Overflow Vulnerabilities

Document Title: =============== Sync Breeze v9.5.16 - Buffer Overflow Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2045 Video: https://www.vulnerability-lab.com/getcontent.php?id=2049 Release Date: ============= 2017-03-28 Vulnerabili...

LibTIFF heap buffer overflow vulnerability (CNVD-2017-04922)

LibTIFF is a library for reading and writing the Tagged Image File Format abbreviated as TIFF. A heap buffer overflow vulnerability exists in LibTIFF version 4.0.7. A remote attacker could use this vulnerability to cause a denial of service heap-based buffer out-of-bounds read with specially...

CentOS 6 : libguestfs (CESA-2017:0564)

An update for libguestfs is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

libguestfs, ocaml, perl, python, ruby security update

CentOS Errata and Security Advisory CESA-2017:0564 An update for libguestfs is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

Integer overflow

Multiple integer overflows in the 1 jasrealloc function in base/jasmalloc.c and 2 memresize function in base/jasstream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities...

The vulnerability of the console-based graphic editor ImageMagick, which allows a hacker to trigger a service failure

The vulnerability of the WriteImages function in the console-based image editing tool ImageMagick is related to pointer dereferencing errors. Exploiting this vulnerability can allow an attacker, operating remotely, to trigger a service failure dereferencing the null pointer using a specially...

openjpeg security update

1.5.1-16 - Revert previous changes in patch for CVE-2016-5159 - Fix memory leaks Related: 1419772 1.5.1-15 - Add two more allocation checks to patch for CVE-2016-5159 Related: 1419772 1.5.1-14 - Fix CWE-825 errors in patch for CVE-2016-5158 Related: 1419772 1.5.1-13 - Add patches for CVE-2016-513...

Moderate: Red Hat Security Advisory: libguestfs security and bug fix update

An update for libguestfs is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

VideoPad Video Editor Handles BMP Format with Memory Corruption Vulnerability

VideoPad Video Editor is an image processing tool. A memory corruption vulnerability exists in VideoPad Video Editor when processing BMP format images. The vulnerability allows an attacker to cause a program crash by constructing a malformed BMP format, which if successfully exploited, can lead t...

Denial Of Service (DoS) Through Heap Out-of-bounds Read

ImageMagick is vulnerable to denial of service DoS attacks. The vulnerability exists in coders/tiff.c where it is possible to read beyond an allocated heap buffer when reading CMYK TIFF Images due to insufficient checks...

[SECURITY] Fedora 25 Update: icoutils-0.31.2-1.fc25

The icoutils are a set of programs for extracting and converting images in Microsoft Windows icon and cursor files. These files usually have the extension .ico or .cur, but they can also be embedded in executables or libraries...

USN-3232-1 imagemagick vulnerabilities

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of th...