3888 matches found
CVE-2017-7210
objdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer over-reads of size 1 and size 8 while handling corrupt STABS enum type strings in a crafted object file, leading to program crash...
Heap overflow
The peILFobjectp function in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2lin...
glibc: Unbounded stack allocation in nan* functions
A stack overflow vulnerability was found in nan functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code...
CVE-2017-7210
objdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer over-reads of size 1 and size 8 while handling corrupt STABS enum type strings in a crafted object file, leading to program crash...
UBUNTU-CVE-2017-7210
objdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer over-reads of size 1 and size 8 while handling corrupt STABS enum type strings in a crafted object file, leading to program crash...
Ubuntu 14.04 LTS / 16.04 LTS : libxml2 vulnerabilities (USN-3235-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3235-1 advisory. It was discovered that libxml2 incorrectly handled format strings. If a user or automated system were tricked into opening a specially crafte...
Dashbuilder: insecure handling of CSRF token
It has been reported that CSRF tokens are not properly handled in JBoss BPM suite dashbuilder. Old tokens generated during an active session can be used to bypass CSRF protection. In addition, the tokens are sent in query string so they can be exposed through the browser's history, referrers, web...
USN-3235-1: libxml2 vulnerabilities
It was discovered that libxml2 incorrectly handled format strings. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS...
CVE-2017-5196: Out-of-bounds Read
Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service out-of-bounds read and crash via vectors involving strings that are not UTF8...
Fedora 24 : gnome-boxes (2017-42df4eeb59)
gnome-boxes 3.20.4 release, fixing a possible security issue with storing the express installation password in clear text. - Store the user password in the keyring during an express installation. - Fix typo in debug string. - Fix printf format strings. Note that Tenable Network Security has...
Medium: openldap
Issue Overview: A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled. Affected Packages: openldap Issue Correction: Run yum update openldap or yum update --advisory ALAS-2017-799 to updat...
Fedora 25 : gnome-boxes (2017-fc0140d4c5)
gnome-boxes 3.22.4 release, fixing a possible security issue with storing the express installation password in clear text. - Store the user password in the keyring during an express installation. - Fix typo in debug string in vm-configurator. - Fix printf format strings in the selectiontoolbar...
Ubuntu 14.04 LTS / 16.04 LTS : Irssi vulnerabilities (USN-3184-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3184-1 advisory. It was discovered that the Irssi buf.pl script set incorrect permissions. A local attacker could use this issue to retrieve another user's...
USN-3184-1 irssi vulnerabilities
It was discovered that the Irssi buf.pl script set incorrect permissions. A local attacker could use this issue to retrieve another user's window contents. CVE-2016-7553 Joseph Bisch discovered that Irssi incorrectly handled comparing nicks. A remote attacker could use this issue to cause Irssi t...
USN-3184-1: Irssi vulnerabilities
It was discovered that the Irssi buf.pl script set incorrect permissions. A local attacker could use this issue to retrieve another user's window contents. CVE-2016-7553 Joseph Bisch discovered that Irssi incorrectly handled comparing nicks. A remote attacker could use this issue to cause Irssi t...
TrueOnline / ZyXEL P660HN-T v1 Router Unauthenticated Command Injection Exploit
TrueOnline is a major ISP in Thailand, and it distributes a customised version of the ZyXEL P660HN-T v1 router. This customised version has an unauthenticated command injection vulnerability in the remote log forwarding page. This Metasploit module was tested in an emulated environment, as the...
TrueOnline / Billion 5200W-T Router Unauthenticated Command Injection Exploit
TrueOnline is a major ISP in Thailand, and it distributes a customized version of the Billion 5200W-T router. This customized version has at least two command injection vulnerabilities, one authenticated and one unauthenticated, on different firmware versions. This Metasploit module will attempt ...
UBUNTU-CVE-2013-7454
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via nested forbidden strings...
