3885 matches found
Joyent SmartOS dtrace Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose information on vulnerable installations of Joyent SmartOS. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists within the dtrace implementation in SmartOS. A functi...
CVE-2016-6139
SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka SAP Security Note 2203591...
OpenOffice Impress MetaActions Arbitrary Read/Write Vulnerability
OpenOffice.org is a cross-platform office software suite that runs on Windows, Linux, MacOS X X11 and Solaris. Openoffice has an out-of-bounds vulnerability in the handling of MetaActions. An attacker can trigger the vulnerability by causing out-of-bounds reads and writes with an Open Office...
openSUSE Security Update : ImageMagick (openSUSE-2016-840)
ImageMagick was updated to fix 66 security issues. These security issues were fixed : - CVE-2014-9810: SEGV in dpx file handler bsc983803. - CVE-2014-9811: Crash in xwd file handler bsc984032. - CVE-2014-9812: NULL pointer dereference in ps file handling bsc984137. - CVE-2014-9813: Crash on...
libical 0.47 / 1.0 Crash
Hello lists Attached is a test case for causing a crash in libical 0.47 shipped with Thunderbird and this was also tested against 1.0 various versions shipped with various email clients. ================================================================= ==24662==ERROR: AddressSanitizer: SEGV on...
Google Chrome - GPU Process MailboxManagerImpl Double-Read
Google Chrome - GPU Process MailboxManagerImpl Double-Read Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=780 Several functions in the GPU command buffer service interact with the GPU mailbox manager gpu/commandbuffer/service/mailboxmanagerimpl.cc, passing a reference to shared...
Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2989-1)
The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2989-1 advisory. Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use th...
Graphite2 - NameTable::getName Multiple Heap Based Out-of-Bounds Reads
Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=756 We have encountered several different crashes in the graphite2::NameTable::getName method, observed in an ASAN build of the standard Graphite2 gr2FontTest utility git trunk,...
Joyent SmartOS dtrace Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose information on vulnerable installations of Joyent SmartOS. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists within the dtrace implementation in SmartOS. A functi...
Internet Bug Bounty: Out-of-bounds reads in zif_grapheme_stripos with negative offset
https://bugs.php.net/bug.php?id=72061 graphemestripos from the intl extension had a security issue when handling negative offsets, this allowed to read from arbitrary memory locations. Reported to developers on 2016-04-24, fixed 2016-04-29 and released at 2016-04-28, affected PHP 5.5 , 5.6 and 7...
imlib2 Integer Overflow Vulnerability
imlib2 is a general-purpose graphics loading and rendering library. An integer overflow vulnerability exists in imlib2 that can be exploited by an attacker to cause a denial of service invalid reads and large memory allocations...
Perl 5.22 VDir::MapPathA/W Out-Of-Bounds Reads / Buffer Over-Reads
---------------------------------------------------------------- Name: Perl 5.22 VDir::MapPathA/W Out-of-bounds Reads and Buffer Over-reads Discovered By: John Leitch, Bryce Darling Url: http://autosectools.com/Perl-VDir-MapPath-Out-of-bounds-Read Report:...
Amazon Linux AMI : kernel (ALAS-2016-669)
When running as a Xen 64-bit PV guest, user mode processes not supposed to be able to access I/O ports may be granted such permission, potentially resulting in one or more of in-guest privilege escalation, guest crashes Denial of Service, or in-guest information leaks. CVE-2016-3157 In some cases...
Medium: kernel
Issue Overview: When running as a Xen 64-bit PV guest, user mode processes not supposed to be able to access I/O ports may be granted such permission, potentially resulting in one or more of in-guest privilege escalation, guest crashes Denial of Service, or in-guest information leaks. CVE-2016-31...
Mageia: Security Advisory (MGASA-2016-0077)
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Updated graphite2/firefox packages fix security vulnerability
Multiple vulnerabilities in the graphite2 font library can result in information disclosure, denial-of-service application crashes, or code execution via out-of-bounds reads, a NULL pointer dereference, and a heap-based buffer overflow CVE-2016-1521, CVE-2016-1522, CVE-2016-1523, CVE-2016-1526...
libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions
It was discovered that the pnggetPLTE and pngsetPLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer...
NEC EXPRESSCLUSTER X-1 on Linux Solaris Directory Traversal Vulnerability
NEC EXPRESSCLUSTER X on Windows, Linux, and Solaris is a suite of clustering software dual hot standby software from Nippon Electric Company NEC for Windows, Linux, and Solaris platforms. The software provides features such as shared disk arrays, automatic error detection and notification, and...
