WhatsApp and Telegram Vulnerabilities Opened Users to Account Takeover

Encrypted messaging services WhatsApp and Telegram patched vulnerabilities in the last week that could have let an attacker take over a user’s account, access personal and group conversations, along with photos, videos and other files. A trio of researchers with Check Point Software Technologies,...

Debian DSA-3798-1 : tnef - security update

Eric Sesterhenn, from X41 D-Sec GmbH, discovered several vulnerabilities in tnef, a tool used to unpack MIME attachments of type 'application/ms-tnef'. Multiple heap overflows, type confusions and out of bound reads and writes could be exploited by tricking a user into opening a malicious...

[SECURITY] [DSA 3798-1] tnef security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3798-1 [email protected] https://www.debian.org/security/ Sebastien Delafond March 01, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3798-1] tnef security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3798-1 [email protected] https://www.debian.org/security/ Sebastien Delafond March 01, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3798-1 (tnef - security update)

Eric Sesterhenn, from X41 D-Sec GmbH, discovered several vulnerabilities in tnef, a tool used to unpack MIME attachments of type application/ms-tnef . Multiple heap overflows, type confusions and out of bound reads and writes could be exploited by tricking a user into opening a malicious...

[20170407] - Core - ACL Violations

Inadequate mime type checks allowed low-privilege users to upload swf files even if they were explicitly forbidden...

Chrome: bypass for download filetype blacklist, extension->native privesc

This bug report describes a vulnerability that can be used by an extension with some permissions to escalate to native code execution on Linux desktops if Java is installed. No user interaction is required. Chrome permits extensions with appropriate permissions "downloads" and "downloads. open" t...

CVE-2017-3827

A vulnerability in the Multipurpose Internet Mail Extensions MIME scanner of Cisco AsyncOS Software for Cisco Email Security Appliances ESA and Web Security Appliances WSA could allow an unauthenticated, remote attacker to bypass configured user filters on the device. Affected Products: This...

CVE-2017-3827

A vulnerability in the Multipurpose Internet Mail Extensions MIME scanner of Cisco AsyncOS Software for Cisco Email Security Appliances ESA and Web Security Appliances WSA could allow an unauthenticated, remote attacker to bypass configured user filters on the device. Affected Products: This...

CVE-2017-3827

CVE-2017-3827 affects Cisco AsyncOS MIME scanner in Cisco ESA/WSA. A remote, unauthenticated attacker can bypass configured user filters due to improper handling of malformed MIME headers, enabling bypass of filter protections on affected devices. Affected releases include Cisco ESA/WSA versions ...

CVE-2017-3827: Improper Input Validation

A vulnerability in the Multipurpose Internet Mail Extensions MIME scanner of Cisco AsyncOS Software for Cisco Email Security Appliances ESA and Web Security Appliances WSA could allow an unauthenticated, remote attacker to bypass configured user filters on the device. Affected Products: This...

PT-2017-16125

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS Software for Cisco Email Security Appliances ESA and Web Security Appliances WSA versions prior to the first fixed release Description A vulnerability in the Multipurpose Internet Mail Extensions MIME scanner could allow an...

CVE-2016-4689

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Mail" component, which does not alert the user to an S/MIME email signature that used a revoked certificate...

Code injection

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Mail" component, which does not alert the user to an S/MIME email signature that used a revoked certificate...

CVE-2016-4689

The CVE-2016-4689 entry affects Apple iOS Mail prior to 10.2. Root cause: the S/MIME policy failed to check whether a certificate was revoked, allowing an email signed with a revoked certificate to appear valid. Impact: users could be misled into trusting revoked-signature emails. Mitigation: App...

CVE-2016-4689

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Mail" component, which does not alert the user to an S/MIME email signature that used a revoked certificate...

PT-2017-1317

Name of the Vulnerable Software and Affected Versions iOS versions prior to 10.2 Description The issue involves the Mail component, which does not alert the user to an S/MIME email signature that used a revoked certificate. This could allow a remote attacker to affect the integrity of protected...

CVE-2016-4689: Undefined Security Weakness

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Mail" component, which does not alert the user to an S/MIME email signature that used a revoked certificate...

Cisco AsyncOS Software for Cisco WSA Filtering Bypass Vulnerability

A vulnerability in the Multipurpose Internet Mail Extensions MIME scanner of Cisco AsyncOS Software for Web Security Appliances WSA could allow an unauthenticated, remote attacker to bypass configured user filters on the device. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions mig...

Cisco AsyncOS Software for Cisco ESA Filtering Bypass Vulnerability

A vulnerability in the Multipurpose Internet Mail Extensions MIME scanner of Cisco AsyncOS Software for Cisco Email Security Appliances ESA could allow an unauthenticated, remote attacker to bypass configured user filters on the device. SPDX-FileCopyrightText: 2017 Greenbone AG Some text...