920 matches found
libavc:svc_dec_fuzzer: Heap-buffer-overflow in isvcd_interlyr_motion_mode_pred_dyadic
Project: https://android.googlesource.com/platform/external/libavc https://github.com/ittiam-systems/libavc.git Detailed Report: https://oss-fuzz.com/testcase?key=5151533164789760 Project: libavc Fuzzing Engine: afl Fuzz Target: svcdecfuzzer Job Type: aflasanlibavc Platform Id: linux Crash Type:...
SUSE CVE-2008-2107
The GENERATESEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 32-bit systems, performs a multiplication using values that can produce a zero seed in rare circumstances, which allows context-dependent attackers to predict subsequent values of the rand and mtrand functions an...
SUSE CVE-2011-3188
The 1 IPv4 and 2 IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service disrupted networking or hijack network sessions by predicting...
SUSE CVE-2015-3097
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160, Adobe AIR before 18.0.0.144, Adobe AIR SDK before 18.0.0.144, and Adobe AIR SDK & Compiler before 18.0.0.144 on 64-bit Windows 7 systems do not properly select a random memory address for the Flash heap, which makes it...
SUSE CVE-2017-5753
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis...
SUSE CVE-2018-3693
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis...
SUSE CVE-2020-1773
An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects OTRS Community Edition:...
SUSE CVE-2022-28693
Unprotected alternative channel of return branch target prediction in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...
PT-2023-4440 · Libde265 +3 · Libde265 +3
Name of the Vulnerable Software and Affected Versions: Libde265 version 1.0.10 Description: The issue is related to a heap-buffer-overflow vulnerability in the derive spatial luma vector prediction function in motion.cc of the Libde265 video codec implementation. This vulnerability can be exploit...
PT-2023-1851 · Libde265 +4 · Libde265 +4
Name of the Vulnerable Software and Affected Versions: libde265 version 1.0.10 Description: The issue is related to a NULL pointer dereference in the ff hevc put unweighted pred 8 sse function at sse-motion.cc. This allows attackers to cause a Denial of Service DoS via a crafted input file...
PT-2023-1848 · Libde265 +4 · Libde265 +4
Name of the Vulnerable Software and Affected Versions: libde265 version 1.0.10 Description: The issue is related to a NULL pointer dereference in the ff hevc put weighted pred avg 8 sse function at sse-motion.cc. This allows attackers to cause a Denial of Service DoS via a crafted input file. The...
RHEL 8 : kpatch-patch (RHSA-2020:3073)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3073 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel...
RHEL 8 : kpatch-patch (RHSA-2020:3297)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3297 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel...
A week in security (January 9—15)
Last week on Malwarebytes Labs: Slack private code on GitHub stolen Crypto-inspired Magecart skimmer surfaces via digital crime haven Security vulnerabilities in major car brands revealed Microsoft ends extended support for Windows 7 and Windows Server 2008 today Pokemon NFT card game malware...
2023 prediction: Security workforce shortage will lead to nationally significant cyberattack
If 2022 was any indication, businesses are about to face an unprecedented volume, frequency, and sophistication of cyberthreats in 2023. Global cyberattacks have increased by 483 percent over the last two years, and at the current rate of growth, damage from such attacks will amount to $10.5...
enigmax 安全漏洞
enigmax is a cryptographic program in C by the individual developer Pierre-François Monville. A security vulnerability exists in enigmax version 2.2 and earlier. An attacker exploited the vulnerability to cause the pseudo-random number generator prng to predict seeds...
K64571774: BIG-IP virtual server TCP sequence numbers vulnerability CVE-2020-5947
Security Advisory Description On specific BIG-IP platforms, attackers may be able to obtain TCP sequence numbers from the BIG-IP system that can be reused in future connections with the same source and destination port and IP numbers. CVE-2020-5947 Impact Attackers may be able to spoof TCP packet...
CVE-2016-15005 Cryptographically weak random number generation in github.com/dinever/golf
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests...
hw: cpu: Intel: information disclosure via local access
A flaw was found in hw. The unprotected alternative channel of return branch target prediction in some IntelR Processors may allow an authorized user to enable information disclosure via local access...
hw: cpu: Intel: information disclosure via local access
A flaw was found in hw. The unprotected alternative channel of return branch target prediction in some IntelR Processors may allow an authorized user to enable information disclosure via local access...