CVE-2017-5928

The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now "Time to Tick" approach even with the https://bugzilla.mozilla.org/showbug.cgi?id=1167489c9 protection mechanism in place, which makes it...

CVE-2017-5928

The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now "Time to Tick" approach even with the https://bugzilla.mozilla.org/showbug.cgi?id=1167489c9 protection mechanism in place, which makes it...

CVE-2017-5928

CVE-2017-5928 maps to a timing-related vulnerability in the W3C High Resolution Time API. The issue arises because memory-reference times can be measured in ways Cited as a “Time to Tick” approach, which bypasses protection mechanisms (e.g., Mozilla’s 1167489#c9) and facilitates AnC-style attacks...

CVE-2017-5928: Undefined Security Weakness

The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now "Time to Tick" approach even with the https://bugzilla.mozilla.org/showbug.cgi?id=1167489c9 protection mechanism in place, which makes it...

PT-2017-16765

Name of the Vulnerable Software and Affected Versions W3C High Resolution Time API affected versions not specified Description The issue concerns the W3C High Resolution Time API implementation in web browsers, where memory-reference times can be measured using a performance.now "Time to Tick"...

Cross-site Scripting (XSS)

i18next is vulnerable to cross-site scripting XSS attacks. The interpolation resolution code in translate.js loops over each key in the dictionary and applies replacements one at a time. It is possible for an untrusted user to input the name of another key in the dictionary. Along with the...

Ruby Archive::Tar::Minitar: Directory traversal

Background Archive::Tar::Minitar is a pure-Ruby library and command-line utility that provides the ability to deal with POSIX tar1 archive files. Description Michal Marek discovered that Ruby Archive::Tar::Minitar is vulnerable to a directory traversal vulnerability. Impact A remote attacker coul...

PT-2017-1368

Name of the Vulnerable Software and Affected Versions iOS versions prior to 10.2 macOS versions prior to 10.12.2 watchOS versions prior to 3.1.3 Description The issue involves the libarchive component, which allows local users to write to arbitrary files via vectors related to symlinks. This is d...

Mozilla Thunderbird: Multiple vulnerabilities

Background Mozilla Thunderbird is a popular open-source email client from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by enticing a user to open a...

Citrix Store Front MMC console crashes with RSA Authentication Agent 1.0 installed.

Even after uninstalling the RSA Authentication Agent 1.0 we get following error in event viewer logs: Error while creating the Citrix StoreFront Snap-in. Microsoft.Practices.Unity.ResolutionFailedException: Resolution of the dependency failed, type =...

Graphviz: Multiple vulnerabilities

Background Graphviz is an open source graph visualization software. Description Multiple vulnerabilities in Graphviz were discovered. Please review the CVE identifiers referenced below for details. Impact A remote attacker, able to control input matched against a regular expression or by enticing...

OPENSUSE-SU-2017:0413-1 Security update for irssi

The IRC textmode client irssi was updated to version 1.0.1 to fix bugs and security issues. irssi 1.0.1: Fix Perl compilation in object dir Fix incorrect HELP SERVER example Correct memory leak in /OP and /VOICE Fix regression that broke second level completion Correct missing NULL termination in...

SUSE-SU-2017:0346-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: Oracle Critical Patch Update of January 2017 bsc1020905 Upgrade to version jdk8u121 icedtea 3.3.0: - S8138725: Add options for Javadoc generation - S8140353: Improve signature checking - S8151934, CVE-2017-3231: Resolve class resolution...

FFmpeg: Multiple vulnerabilities

Background FFmpeg is a complete, cross-platform solution to record, convert and stream audio and video. Description Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details. Impact Remote attackers could cause a Denial of Service...

Oracle JRE/JDK: Multiple vulnerabilities

Background Java Platform, Standard Edition Java SE lets you develop and deploy Java applications on desktops and servers, as well as in today’s demanding embedded environments. Java offers the rich user interface, performance, versatility, portability, and security that today’s applications...

PT-2017-1275

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 56.0.2924.76 for Linux, Windows and Mac Google Chrome version prior to 56.0.2924.87 for Android Description The issue arises from the Blink component in Google Chrome resolving promises in an inappropriate...

Graphite: Multiple vulnerabilities

Background Graphite is a “smart font” system developed specifically to handle the complexities of lesser-known languages of the world. Description Multiple vulnerabilities have been discovered in Graphite. Please review the CVE identifiers referenced below for details. Impact A remote attacker...

T1Lib: : Multiple vulnerabilities

Background T1Lib is a library for rasterizing bitmaps from Adobe Type 1 fonts. Description Multiple vulnerabilities have been discovered in T1Lib. Please review the CVE identifiers referenced below for details. Impact Remote attackers, by coercing users to process specially crafted AFM font or PD...

EMC Avamar Data Store / Virtual Edition 7.3.1 / 7.3.0 Privilege Escalation Vulnerability

Exploit for windows platform in category web applications ESA-2016-146: EMC Avamar Data Store and Avamar Virtual Edition Privilege Escalation Vulnerability EMC Identifier: ESA-2016-146 CVE Identifier: CVE-2016-8214 Severity Rating: CVSSv3 Base Score: 6.7 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affect...

QEMU: Multiple vulnerabilities

Background QEMU is a generic and open source machine emulator and virtualizer. Description Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details. Impact A privileged user/process within a guest QEMU environment can cause a Denial of...