Information disclosure

An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission levels. This issue is rated as Moderate because it is a general bypass for a user level defense in depth or exploit mitigation technology ...

UBUNTU-CVE-2017-0414

An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does...

CVE-2017-0424

CVE-2017-0424 affects AOSP Messaging in Android (versions 6.0–7.1.1). It is an information disclosure vulnerability that could allow a local malicious app to bypass OS protections and access data outside its permitted scope when processing a specially crafted file. The issue is described as a mod...

CVE-2017-0414

An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does...

CVE-2017-0413

CVE-2017-0413 is an information-disclosure vulnerability in AOSP Messaging on Android (versions 6.0, 6.0.1, 7.0, 7.1.1). The issue could allow a local malicious application to bypass OS protections that isolate app data, exposing data the app should not access. The description and connected sourc...

CVE-2017-0414

CVE-2017-0414 refers to an information-disclosure vulnerability in AOSP Messaging on Android (versions 6.0, 6.0.1, 7.0, 7.1.1). The issue allows a local malicious application to bypass OS protections that isolate app data, potentially accessing data the app should not access. The connected docume...

CVE-2017-0424

An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission levels. This issue is rated as Moderate because it is a general bypass for a user level defense in depth or exploit mitigation technology ...

CVE-2017-0413

An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does...

[SECURITY] Fedora 25 Update: fedmsg-0.18.2-1.fc25

Python API used around Fedora Infrastructure to send and receive messages w ith zeromq. Includes some CLI tools...

Cisco WebEx - nativeMessaging Arbitrary Remote Command Execution Vulnerability

Exploit for windows platform in category remote exploits Cisco's WebEx extension jlhmfgmfgeifomenelglieieghnjghma has 20M active users, and is part of Cisco's popular web conferencing software. The extension works on any URL that contains the magic pattern...

Cisco WebEx - nativeMessaging Remote Command Execution

Cisco WebEx - nativeMessaging Remote Command Execution !-- Cisco's WebEx extension jlhmfgmfgeifomenelglieieghnjghma has 20M active users, and is part of Cisco's popular web conferencing software. The extension works on any URL that contains the magic pattern...

Cisco WebEx Browser Plugin Remote Code Execution Vulnerability

Cisco WebEx is a browser extension plug-in and part of the Cisco web conferencing software. A remote code execution vulnerability exists in the Cisco WebEx browser plug-in. The extension uses nativeMessaging, and an attacker can exploit the vulnerability to execute arbitrary code in a browser usi...

Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution

This module exploits a command injection vulnerability in the Trend Micro IMSVA product. An authenticated user can execute a terminal command under the context of the web server user which is root. Besides, default installation of IMSVA comes with a default administrator credentials. saveCert.ims...

Pidgin: Multiple vulnerabilities

Background Pidgin is a client for a variety of instant messaging protocols. Description Multiple vulnerabilities have been discovered in Pidgin. Please review the CVE identifiers referenced below for details. Impact A remote attacker might send specially crafted data using the MXit protocol,...

Google's Key Transparency Simplifies Public Key Lookups

Google has taken a big step toward simplifying public key lookups at Internet scale with the release to open source on Thursday of Key Transparency. Key Transparency is admittedly a prototype, Google said, but it could provide significant relief for secure messaging systems suffering from...

Lawmakers Reintroduce Popular Email Privacy Act

A group of bipartisan lawmakers reintroduced the Email Privacy Act, a bill that would require law enforcement to get a warrant before searching email, Facebook messages and files stored on cloud services no matter how old the archives. The Email Privacy Act is an attempt to reform the decade-old...

DEBIAN-CVE-2016-2365

A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger th...

libotr, Pidgin OTR: Remote execution of arbitrary code

Background Pidgin Off-the-Record OTR messaging allows you to have private conversations over instant messaging. libotr is a portable off-the-record messaging library. Description Multiple vulnerabilities exist in both libotr and Pidgin OTR. Please review the CVE identifiers for more information...

[SECURITY] Fedora 25 Update: smack-4.1.5-3.fc25

Smack is an Open Source XMPP Jabber client library for instant messaging and presence. A pure Java library, it can be embedded into your applications to create anything from a full XMPP client to simple XMPP integrations such as sending notification messages and presence-enabling devices...

Mozilla: Data from Pocket server improperly sanitized before execution (MFSA 2016-94, MFSA 2016-95)

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" unprivileged page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR 45.6 and Firefox...