Mouse Offset Behavior During Multiple ICA Session in Receiver for Windows and Windows (Store)

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Attempting to run multiple ICA sessions simultaneously, may cause high memory and Disk I/O activity,...

DEBIAN-CVE-2017-15298

Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service memory consumption via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to...

The scrypt parameters

The recommended scrypt parameters in the Go docs were recently brought up for discussion given they havent changed since 2009. Even if at this point I memorized the three numbers N=16384, r=8, p=1 I only have a vague understanding of their meaning, so I took some time to read the scrypt paper. It...

samba: fd_open_atomic infinite loop due to wrong handling of dangling symlinks

A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU and memory...

The vulnerability of the cine_read_header function in the FFmpeg multimedia library allows a attacker to trigger memory consumption and service failure.

The vulnerability of the cinereadheader function in the FFmpeg multimedia library is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to induce memory consumption and service failures by using a specially created CINE file. This file requires a larg...

The vulnerability of the GNU Patch software tool for Unix-based operating systems, such as Ubuntu, Fedora, and the Linux distribution Mageia, allows a hacker to cause a service failure by using a specially created diff file.

The vulnerability of the GNU Patch software tool for Unix-based operating systems, such as Ubuntu, Fedora, and the Linux distribution Mageia, is related to resource management errors memory consumption. Exploiting this vulnerability allows a malicious actor to cause service failures memory...

DEBIAN-CVE-2017-14222

In libavformat/mov.c in FFmpeg 3.3.3, a DoS in readtfra due to lack of an EOF End of File check might cause huge CPU and memory consumption. When a crafted MOV file, which claims a large "itemcount" field in the header but does not contain sufficient backing data, is provided, the loop would...

ALPINE-CVE-2017-14222

In libavformat/mov.c in FFmpeg 3.3.3, a DoS in readtfra due to lack of an EOF End of File check might cause huge CPU and memory consumption. When a crafted MOV file, which claims a large "itemcount" field in the header but does not contain sufficient backing data, is provided, the loop would...

DEBIAN-CVE-2017-14223

In libavformat/asfdecf.c in FFmpeg 3.3.3, a DoS in asfbuildsimpleindex due to lack of an EOF End of File check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would...

DEBIAN-CVE-2017-14158

Scrapy 1.4 allows remote attackers to cause a denial of service memory consumption via large files because arbitrarily many files are read into memory, which is especially problematic if the files are then individually written in a separate thread to a slow storage resource, as demonstrated by...

The vulnerability of the Android CAF-release operating system, related to resource management errors, allows attackers to exploit excessive memory usage.

The vulnerability of the Android CAF-release operating system is related to resource management errors. Exploiting this vulnerability allows a remote attacker to utilize excessive memory during file loading...

DEBIAN-CVE-2017-14057

In FFmpeg 3.3.3, a DoS in asfreadmarker due to lack of an EOF End of File check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "namelen" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name an...

GraphicsMagick Denial of Service Vulnerability (CNVD-2017-24319)

GraphicsMagick is a simple set of image processing tools. The tool provides resizing, rotating, highlighting and other functions to images. A denial of service vulnerability exists in the 'ReadJNXImage' function in the coders/jnx.c file in GraphicsMagick version 1.3.26. An attacker can exploit th...

CVE-2017-13777

GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it...

DEBIAN-CVE-2017-13776

GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage in a coders/xbm.c "Read hex image data" version!=10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it...

Low: Red Hat Security Advisory: rh-nginx110-nginx security update

An update for rh-nginx110-nginx is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

[SECURITY] Fedora 26 Update: nginx-1.12.1-1.fc26

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

OpenJDK: insecure XML parsing in wsdlimport (JAX-WS, 8182054)

It was discovered that the wsdlimport tool in the JAX-WS component of OpenJDK did not use secure XML parser settings when parsing WSDL XML documents. A specially crafted WSDL document could cause wsdlimport to use an excessive amount of CPU and memory, open connections to other hosts, or leak...

OpenJDK: reading of unprocessed image data in JPEGImageReader (2D, 8169209)

It was discovered that the JPEGImageReader implementation in the 2D component of OpenJDK would, in certain cases, read all image data even if it was not used later. A specially crafted image could cause a Java application to temporarily use an excessive amount of CPU and memory...

ImageMagick Denial of Service Vulnerability (CNVD-2017-236955)

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. A denial of service vulnerability exists in the 'formatIPTC' function of the coders/meta.c file in ImageMagick version...