CVE-2017-16368: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability leads to a stack-based buffer overflow condition in the internal Unicode string...

CVE-2017-11007

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possibility of stack corruption due to buffer overflow of Partition name while converting ascii string to unicode string in function HandleMetaImgFlash...

Stack overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possibility of stack corruption due to buffer overflow of Partition name while converting ascii string to unicode string in function HandleMetaImgFlash...

GHSA-9FH3-VH3H-Q4G3 activesupport Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a...

activesupport Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a...

FLARE Script Series: Querying Dynamic State using the FireEye Labs Query-Oriented Debugger (flare-qdb)

Introduction This post continues the FireEye Labs Advanced Reverse Engineering FLARE script series. Here, we introduce flare-qdb, a command-line utility and Python module based on vivisect for querying and altering dynamic binary state conveniently, iteratively, and at scale. flare-qdb works on...

Debian DLA-761-2 : python-bottle regression update

The update for python-bottle issued as DLA 761-1 would cause a crash if a unicode string was used in a header. Updated packages are now available to correct this issue. For Debian 7 'Wheezy', these problems have been fixed in version 0.10.11-1+deb7u3. We recommend that you upgrade your...

openSUSE Security Update : kde-cli-tools5 (openSUSE-2016-1171)

This update for kde-cli-tools5 fixes the following vulnerability : - CVE-2016-7787: user could sneak an unicode string terminator in the kdesu invocation boo1001916 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

OPENSUSE-SU-2016:2498-1 Security update for kde-cli-tools5

This update for kde-cli-tools5 fixes the following vulnerability: CVE-2016-7787: user could sneak an unicode string terminator in the kdesu invocation boo1001916...

VUPlayer 2.49 - (.pls) Buffer Overflow Vulnerability

VUPlayer is a freeware multi-format audio player for windows. Copy of the Vendor Homepage: http://vuplayer.com/vuplayer.php Technical Details & Description: ================================ The classic buffer overflow vulnerability is located in the software VUPlayer an attacker can manipulate th...

VUPlayer 2.49 - (.wax) Buffer Overflow Vulnerability

Product & Service Introduction: =============================== VUPlayer is a freeware multi-format audio player for windows. Copy of the Vendor Homepage: http://vuplayer.com/vuplayer.php Technical Details & Description: ================================ The classic buffer overflow vulnerability i...

UBUNTU-CVE-2015-8790

The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string, which triggers an invalid memory access...

Mac OS X Code Execution

The vulnerability of the Speech UI component in the Mac OS X operating system arises due to buffer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure by using a specially crafted Unicode string...

Apple OS X Speech UI Memory Corruption Vulnerability

Apple OS X is a BSD-based operating system distributed by Apple. A memory corruption vulnerability exists in the Apple OS X Speech UI, which allows remote attackers to exploit the vulnerability by submitting a special Unicode string and tricking an application into parsing it, which can execute...

CVE-2015-3794

The Speech UI in Apple OS X before 10.10.5, when speech alerts are enabled, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted Unicode string...

Design/Logic Flaw

The Speech UI in Apple OS X before 10.10.5, when speech alerts are enabled, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted Unicode string...

CVE-2015-3794

The Speech UI in Apple OS X before 10.10.5, when speech alerts are enabled, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted Unicode string...

UBUNTU-CVE-2015-1609

MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request...

CVE-2015-0925

The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname...