CVE-2017-14617

In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files...

Cross-site Scripting (XSS)

dompdf is vulnerable to cross-site scripting XSS attacks. The library does not filter user-supplied strings through uploaded pdf files, allowing a malicious user to inject and execute arbitrary web script...

CVE-2017-14520

In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd in Splash.cc, which may lead to a potential attack when handling malicious PDF files...

DEBIAN-CVE-2017-14520

In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd in Splash.cc, which may lead to a potential attack when handling malicious PDF files...

CVE-2017-14520

Poppler 0.59.0 contains a vulnerability where a floating point exception can occur in Splash::scaleImageYuXd() inside Splash.cc when processing crafted PDFs, potentially enabling an attack via malicious files. Connected advisories from multiple distributions (openSUSE SUSE-2018:648, SUSE-SU-2018:...

CVE-2017-14520

In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd in Splash.cc, which may lead to a potential attack when handling malicious PDF files...

CVE-2017-14520

In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd in Splash.cc, which may lead to a potential attack when handling malicious PDF files...

Russian Hacking Tools Codenamed WhiteBear Exposed

Kaspersky Labs exposed a highly sophisticated set of hacking tools from Russia called WhiteBear. From February to September 2016, WhiteBear activity was narrowly focused on embassies and consular operations around the world. All of these early WhiteBear targets were related to embassies and...

Introducing WhiteBear

As a part of our Kaspersky APT Intelligence Reporting subscription, customers received an update in mid-February 2017 on some interesting APT activity that we called WhiteBear. Much of the contents of that report are reproduced here. WhiteBear is a parallel project or second stage of the Skipper...

Stellar.org: Direct URL access to PDF files

hi, I was able to access the following PDF files without any authentication https://www.stellar.org/wp-content/uploads/2014/07/Bylaws-00580045-10.pdf https://www.stellar.org/wp-content/uploads/2014/07/FILED-STELLAR-DEVELOPMENT-FOUNDATION-00594674.pdf the pdf files under path...

Adobe Acrobat Pro DC PDF Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

July 11, 2017—KB4025344 (OS Build 10586.1007)

None None...

Foxit Reader PDF Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

openSUSE Security Update : otrs (openSUSE-2017-691)

This update for otrs fixes the following issues : - CVE-2017-9324: Incorrect Access Control in OTRS - Improved SecureMode detection in Installer OSA-2017-03, bsc1043086 - bsc1043244: Reflected cross-site scripting in OTRS, customer search should not return results for internal OSA-2017-02 In...

Security Update for Microsoft Office Products (June 2017)

The Microsoft Office application installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple remote code execution vulnerabilities exist in Microsoft Office due to improper validation of input before loading dynamic link...

Microsoft Office Word Multiple Remote Code Execution Vulnerabilities (3203393)

This host is missing an important security update according to Microsoft KB3203393. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

Microsoft Word Multiple Remote Code Execution Vulnerabilities (KB3191945)

This host is missing an important security update according to Microsoft KB3191945 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Windows Server 2012 June 2017 Security Updates

The remote Windows host is missing security update 4022718 or cumulative update 4022724. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows Hyper-V instruction emulation due to a failure to properly enforce privilege levels. An...

Debian DLA-968-1 : libpodofo security update

Several heap-based buffer overflows and NULL pointer dereferences have been discovered in libpodofo, a library for manipulating PDF files, that allow remote attackers to cause a denial of service application crash or other unspecified impact via a crafted PDF document. For Debian 7 'Wheezy', thes...

[SECURITY] [DLA 968-1] libpodofo security update

Package : libpodofo Version : 0.9.0-1.1+deb7u2 CVE ID : CVE-2017-6840 CVE-2017-6842 CVE-2017-6843 CVE-2017-6847 CVE-2017-6848 CVE-2017-7378 CVE-2017-7380 CVE-2017-7381 CVE-2017-7382 CVE-2017-7383 Debian Bug : 861557 861564 859330 859329 Several heap-based buffer overflows and NULL pointer...