Linux Kernel CVE-2019-9213 NULL Dereferences

By following the codepath that Andrea Arcangeli pointed out in his mails regarding the last bug I reported, I noticed that it is possible for userspace on a normal distro to map virtual address 0, which on an X86 system without SMAP enables the exploitation of kernel NULL pointer dereferences. Th...

Information disclosure

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0602, CVE-2019-0615, CVE-2019-0616, CVE-2019-0660, CVE-2019-0664...

The vulnerability of the Windows GDI component of the Windows operating system, which allows a hacker to compromise sensitive information

The vulnerability of the Windows GDI component of the Windows operating system is related to errors in the memory object handling mechanisms. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially crafted application...

USN-3900-1 libgd2 vulnerabilities

It was discovered that GD incorrectly handled memory when processing certain images. A remote attacker could use this issue with a specially crafted image file to cause GD to crash, resulting in a denial of service, or possibly execute arbitrary code...

CVE-2019-9024

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpcdecode can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64decodexmlrpc in ext/xmlrpc/libxmlrpc/base64.c...

CVE-2019-9021

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the...

Security Updates for Internet Explorer (February 2019)

The Internet Explorer installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists when Internet Explorer accesses objects in memory. The vulnerability could corrupt memory in such a way...

Security Advisory - Memory Double Free Vulnerability in Image Processing Module of Some Huawei Smart Phones

The image processing module of some Huawei smart phones has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can call special API, which could trigger double free and cause a system crash. Vulnerability ID: HWPSIRT-2018-110...

Cisco Firepower Threat Defense Software Denial of Service Vulnerability (CNVD-2020-12741)

Cisco Firepower Threat Defense FTD Software is a suite of unified software that provides next-generation firewall services from Cisco. data acquisition DAQ is one of the data acquisition components. A denial of service vulnerability exists in Cisco Firepower Threat Defense Software, which arises...

The vulnerability of the Microsoft JET Database Engine database driver on the Windows operating system allows a hacker to execute arbitrary code.

The vulnerability of the Microsoft JET Database Engine database driver for the Windows operating system exists due to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created file...

The vulnerability of the Windows operating system’s kernel, which allows a hacker to gain access to protected information

The vulnerability of the Windows operating system’s kernel is related to improper handling of objects in memory. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created application...

Information Disclosure

Linux kernel is vulnerable to information disclosure. The llcuigetname function in net/llc/afllc.c does not correctly return a value in certain circumstances. This allows an attacker to obtain confidential information from the kernel stack memory via a malicious application that uses uninitialize...

Google Chrome DevTools Memory Misreference Vulnerability

Google Chrome is the United States Google Google company developed a Web browser. Devtools is one of the development and debugging tools. A memory misreference vulnerability exists in DevTools in versions of Google Chrome prior to 66.0.3359.117. A local attacker can exploit this vulnerability to...

CVE-2018-16078

CVE-2018-16078 affects Google Chrome’s Autofill: unsafe handling of credit card details in Autofill prior to version 69.0.3497.81 may allow a remote attacker to obtain sensitive information from memory via a crafted HTML page. Publicly documented references from multiple vendors (e.g., OpenSUSE/F...

The vulnerability of the Microsoft Windows operating system’s kernel, which allows a hacker to disclose protected information

The vulnerability of the Microsoft Windows operating system is related to improper handling of objects in memory. Exploiting this vulnerability allows a local attacker to compromise the confidentiality of protected information through a specially created application...

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser allows a hacker to execute arbitrary code in the context of the current user.

The vulnerability of the ChakraCore JavaScript script handler in the Microsoft Edge browser is caused by an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, through a...

CVE-2018-19974

In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can allow attackers to discover addresses in the real stack not the YARA virtual stack...

Mozilla Firefox and Firefox ESR Memory Misreference Vulnerability (CNVD-2018-25867)

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A memory misreference vulnerability exists in Mozilla Firefox versions prior to 64 and Firefox ES...

Adobe Acrobat and Reader Memory Error Reference Hole (CNVD-2019-06907)

Adobe Acrobat and Reader are the United States of America Audobee Adobe company's products. The former is a set of PDF file editing and conversion tools, the latter is a set of PDF document reading software. There is a memory misreference hole in Adobe Acrobat and Reader. Remote attackers can use...

Adobe Acrobat and Reader suffer from a memory out-of-bounds read vulnerability (CNVD-2018-26531)

Adobe Acrobat and Reader are the United States of America Audobee Adobe company's products. The former is a set of PDF file editing and conversion tools, the latter is a set of PDF document reading software. Adobe Acrobat and Reader memory out-of-bounds read vulnerability, remote attackers can us...