[SECURITY] [DLA 998-1] c-ares security update

Package : c-ares Version : 1.9.1-3+deb7u2 CVE ID : CVE-2017-1000381 CVE-2017-1000381 The c-ares function aresparsenaptrreply, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a...

WPS has an out-of-bounds access vulnerability

WPS is a free office software. A memory out-of-bounds access exists in the WPS docreader module. The vulnerability stems from a miscalculation of the buffer address length. An attacker can exploit this vulnerability to obtain sensitive information...

CVE-2017-8494

Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a locally-authenticated attacker to run a specially crafted application on a targeted system when Windows Secure Kernel Mode fails to properly handle objects in memory, aka "Windows Elevation of Privilege Vulnerability...

CVE-2017-8465

Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to run processes in an elevated context when the Windows kernel improperly handles objects in memory, aka "Win32k Elevation of Privilege Vulnerability...

The vulnerability of Microsoft Chakra’s kernel in the Microsoft Edge browser allows a hacker to execute arbitrary code.

The vulnerability in the Microsoft Chakra kernel of the Microsoft Edge browser arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code when accessing objects in memory...

WPS has an out-of-bounds access vulnerability

WPS Office is one of the widely used office software. A memory out-of-bounds access exists in the docreader module of WPS Text. The vulnerability is due to a miscalculation of the buffer length. An attacker can exploit this vulnerability to obtain sensitive information...

Microsoft Edge Scripting Engine Memory Corruption (CVE-2017-8497)

A remote code execution Vulnerability exists in Microsoft Edge. The vulnerability is due to the way JavaScript engine renders when handling objects in memory. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a specially crafted web page...

Microsoft Edge browser vulnerability, allowing a hacker to trigger a service failure

The vulnerability of Microsoft Edge arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause a service failure remotely...

Security Advisory - Memory Double Free Vulnerability in Driver of Some Huawei Smart Phones

The soundtrigger driver of some Huawei smart phones has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which could triggers double free and causes a system crash...

Memory out-of-bounds access vulnerability in WPS text kso module

WPS is an office software developed by Kingsoft Office Software. A memory out-of-bounds access vulnerability exists in the WPS text kso module. The vulnerability is caused by the program failing to validate the buffer length and calling wcslen directly, which could be exploited by an attacker to...

Apple iOS and macOS Sierra SQLite Memory Corruption Vulnerability

Apple iOS and macOS Sierra are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices; macOS Sierra is a specialized operating system developed for Mac computers; SQLite is a C-based, open source, embedded relational database management component developed by D...

USN-3298-1 miniupnpc vulnerability

It was discovered that MiniUPnP incorrectly handled memory. A remote attacker could use this issue to cause a denial of service or possibly execute arbitrary code with privileges of the user running an application that uses the MiniUPnP library...

Memory out-of-bounds write vulnerability in WPS Text WordConvertDll module

WPS is an office software developed by Kingsoft Office Software. A memory out-of-bounds write vulnerability exists in the WPS text WordConvertDll module. The vulnerability is caused due to the program failing to validate the buffer length when the user uses the Traditional and Simplified Conversi...

The vulnerability of the Safari browser, which allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the WebKit component of the Safari browser is caused by an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code...

CVE-2017-0190

CVE-2017-0190 affects the GDI component in multiple Windows platforms (Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold/R2, Windows RT 8.1, Windows 10 (Gold, 1511, 1607), and Windows Server 2016). The vulnerability allows remote attackers to obtain sensitive in...

jasper: incorrect handling of bufsize 0 in mem_resize()

Double free vulnerability in the memclose function in jasstream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted BMP image to the imginfo command...

Memory out-of-bounds access vulnerability in wps

WPS is an office software developed by Kingsoft Office Software. A memory out-of-bounds access vulnerability exists in WPS. The vulnerability is due to the docreader module did not take the length of the value of the more check due to, an attacker can use the vulnerability to obtain sensitive...

The vulnerability of the Flash Player software, which allows a violator to execute arbitrary code

The vulnerability of the Flash Player software is related to the use of memory after it is freed during the execution of internal scripts. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2017-5465

An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content, which could then displayed. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and...

Buffer Overflow Vulnerability

ImageMagick is vulnerable to denial of service DoS attacks and possibly other attacks. The vulnerabilities exists because too many exceptions can be caused in memory.c which can cause a buffer overflow...