Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2185-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2185-1 advisory. Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Jesse Ruderman, Nathan Froyd, John Schoenick, Karl Tomlinson, Vladimir Vukicevic a...

CVE-2014-1525

The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service use-after-free and heap memory...

Use-after-free in the Text Track Manager for HTML video — Mozilla

Using the Address Sanitizer tool, security researcher Abhishek Arya Inferno of the Google Chrome Security Team found a use-after-free in the Text Track Manager while processing HTML video. This was caused by inconsistent garbage collection of Text Track Manager variables and results in a...

SeaMonkey < 2.26 Multiple Vulnerabilities

The installed version of SeaMonkey is a version prior to 2.26 and is, therefore, potentially affected by the following vulnerabilities : - An issue exists in the Network Security NSS library due to improper handling of IDNA domain prefixes for wildcard certificates. This issue could allow man-in-...

mozilla -- multiple vulnerabilities

The Mozilla Project reports: MFSA 2014-34 Miscellaneous memory safety hazards rv:29.0 / rv:24.5 MFSA 2014-35 Privilege escalation through Mozilla Maintenance Service Installer MFSA 2014-36 Web Audio memory corruption issues MFSA 2014-37 Out of bounds read while decoding JPG images MFSA 2014-38...

Apple QuickTime Multiple Vulnerabilities (Mar 2014) - Windows

Apple QuickTime player is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:quicktime";...

CVE-2014-1243

Apple QuickTime before 7.7.5 does not initialize an unspecified pointer, which allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted track list in a movie file...

CVE-2014-1243

Apple QuickTime before 7.7.5 is affected by CVE-2014-1243 due to an uninitialized pointer in track list handling, allowing remote arbitrary code execution or a crash when processing crafted movie files. Exploitation is described in multiple sources (e.g., ZDI-14-044 states a nam atom parsing flaw...

CVE-2014-1854: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter...

CVE-2014-1243: Improper Restriction of Operations within the Bounds of a Memory Buffer

Apple QuickTime before 7.7.5 does not initialize an unspecified pointer, which allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted track list in a movie file...

PT-2014-4329

Name of the Vulnerable Software and Affected Versions AdRotate Pro plugin versions 3.9 through 3.9.5 AdRotate Free plugin versions 3.9 through 3.9.4 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the track parameter in the...

NCH Software Express Burn Plus 4.68缓冲区溢出漏洞

NCH Software是适用于Windows和Mac OS X的音频，视频，听写，商业和计算机实用软件的厂商。 该漏洞是由于项目文件处理时的边界错误引起的，当用户打开例如特制的.EBP文件时，导致一个unicode缓冲区溢出。成功利用此漏洞可能允许执行任意代码。 0 NCH Software Express Burn Plus 4.68 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.nchsoftware.com/ use Cwd; use LWP::Simple; print "\n...

Target Corp. Suffers Black Friday Data Breach

UPDATE – TJX and Heartland Payment Systems may soon have company atop the list of the worst retail data breaches in U.S. history after reports surfaced that Target Corp. was breached around Black Friday and millions of credit and debit cards were stolen. Target confirmed the breach this morning a...

Dennis Fisher and Mike Mimoso Discuss Do Not Track, We Are the Cavalry and more

Dennis Fisher and Mike Mimoso discuss the major security stories of the last two weeks, including the BGP route hijacking, why Do Not Track doesn’t work and the We Are the Cavalry movement. Download: digitalunderground135.mp3...

MIRcon Preview: Why C-Level Executives Should Attend

Security conferences come and go and most are well attended by information security practitioners for professional development and networking. But what about the executives who are responsible for strategy and who hold the budgets - what conferences should they attend? With MIRcon 2013, Nov. 5-6,...

CrowdSource Tool Aims to Improve Automated Malware Analysis

When a new piece of malware surfaces, it’s typically analyzed eight ways from Sunday by a long list of antimalware and other security companies, government agencies, CERTs and other organizations who try to break it down and classify its capabilities. There’s a lot of duplicated effort there, and...

Pinterest Announces Support for DNT Header

Pinterest is the latest major Internet service to support Do Not Track. The social site, which allows its users to organize items of interest, made the announcement on Friday in a note that explained how it was going to suggest personalized pins based on websites the user has visited and placed a...

Mozilla Delays Third-Party Cookie Patch in Firefox

Mozilla has tapped the brakes on its plans to block third-party cookies by default in the Firefox browser. Test versions of Firefox 22, scheduled for a June release, were supposed to include a patch that blocked third-party cookie drops by default. However, Mozilla CTO Brendan Eich said yesterday...

Firefox 21 Launches with 3 critical fixes and new Social Integrations

Mozilla has launched Firefox 21 for Mac, Windows, and Linux, adding a number of improvements, namely to the browser's Social API. "Today, we are adding multiple new social providers Cliqz, Mixi and msnNOW to Firefox," wrote Mozilla in a blog post today. The browser first added Facebook integratio...

Firefox 21 Update Patches 8 Vulnerabilities, 3 Critical

Mozilla fixed eight vulnerabilities, three critical, in the 21st build of its flagship Firefox browser yesterday. One of the fixes remedies an Address Sanitizer memory corruption flaw MFSA 2013-48 that could’ve allowed remote code execution. The other two critical flaws could’ve also led to...