Mozilla: SVG issues found with Address Sanitizer (MFSA 2012-14)

The SVG Filters implementation in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 might allow remote attackers to obtain sensitive information from...

Microsoft Internet Explorer 8 Code Execution

Below is the PoC code for CVE-2011-1999 MS11-081 that accompanies my blog article "Reliable Windows 7 Exploitation: A Case Study" http://ifsec.blogspot.com/2012/02/reliable-windows-7-exploitation-case.html Some notes about the PoC code: - The exploit uses a single vulnerability to both bypass ASL...

CVE-2011-3563

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.235 and earlier allows remote attackers to affect confidentiality and availability via unknown vectors related to Sound...

RHEL 4 : php (RHSA-2012:0071)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0071 advisory. - php: buffer over-read in Exif extension CVE-2011-0708 - php: Crash by converting serial day numbers SDN into Julian calendar CVE-2011-1466...

php: integer overflow in exif_process_IFD_TAG() may lead to DoS or arbitrary memory disclosure

Integer overflow in the exifprocessIFDTAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offsetval value in an EXIF header in a JPEG file, a...

Xpra memory disclosure

Xpra is screen for X11. This is the fork located at: http://xpra.org/ Xpra versions 0.0.7.28 r191 through to 0.0.7.34 r443 return random chunks of memory to the clients by using the wrong size multiplying by 4 for the X11 cursor memory buffer. from XFixesGetCursorImage The byte order of the data...

Xpra memory disclosure

It's possible to access uninitialized memory chunks...

php: integer overflow in exif_process_IFD_TAG() may lead to DoS or arbitrary memory disclosure

Integer overflow in the exifprocessIFDTAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offsetval value in an EXIF header in a JPEG file, a...

php: integer overflow in exif_process_IFD_TAG() may lead to DoS or arbitrary memory disclosure

Integer overflow in the exifprocessIFDTAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offsetval value in an EXIF header in a JPEG file, a...

CVE-2011-3179

The server process in Novell Messenger 2.1 and 2.2.x before 2.2.1, and Novell GroupWise Messenger 2.04 and earlier, allows remote attackers to read from arbitrary memory locations via a crafted command...

Novell Messenger Server Process Memory Remote Information Disclosure

Binary data novellmessengermemorydisclosureremote.nbin...

APPLE-SA-2011-10-26-1 QuickTime 7.7.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-10-26-1 QuickTime 7.7.1 QuickTime 7.7.1 is now available and addresses the following: QuickTime Available for: Windows 7, Vista, XP SP2 or later Impact: Viewing a maliciously crafted movie file may lead to an unexpected application...

ZDI-11-311 : Apple Quicktime Empty URL Data Handler Remote Code Execution Vulnerability

ZDI-11-311 : Apple Quicktime Empty URL Data Handler Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-311 October 27, 2011 -- CVE ID: CVE-2011-3220 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Apple -- Affected Products: Apple Quicktime --...

PT-2012-1509 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.39 Description: The issue is related to the tpm open function in the Linux kernel, which does not properly initialize a certain buffer. This allows local users to potentially obtain sensitive information fro...

CentOS Update for php53 CESA-2011:0196 centos5 i386

Check for the Version of php53 OpenVAS Vulnerability Test CentOS Update for php53 CESA-2011:0196 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

CentOS Update for php53 CESA-2011:0196 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for php CESA-2009:0337 centos4 i386

Check for the Version of php OpenVAS Vulnerability Test CentOS Update for php CESA-2009:0337 centos4 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CentOS Update for php CESA-2009:0337 centos3 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for cyrus-imapd CESA-2009:1116 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

UBUNTU-CVE-2011-2492

The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to 1 the l2capsockgetsockoptold function in...