CVE-2020-6093

An exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling. A specially crafted PDF document can cause uninitialized memory access resulting in information disclosure. In order to trigger this vulnerability, victim must open a malicious file...

Solving Uninitialized Stack Memory on Windows

This blog post outlines the work that Microsoft is doing to eliminate uninitialized stack memory vulnerabilities from Windows and why we’re on this path. This blog post will be broken down into a few parts that folks can jump to: Uninitialized Memory Background Potential Solutions to Uninitialize...

Solving Uninitialized Stack Memory on Windows

This blog post outlines the work that Microsoft is doing to eliminate uninitialized stack memory vulnerabilities from Windows and why we’re on this path. This blog post will be broken down into a few parts that folks can jump to: Uninitialized Memory Background Potential Solutions to Uninitialize...

CVE-2020-10060

CVE-2020-10060 affects Zephyr’s UpdateHub module. The vulnerability arises in updatehub_probe: after JSON parsing, the code accesses objects[1], which can reference uninitialized stack memory if the JSON has fewer than two elements. This could crash the process, cause a denial of service, or pote...

Remote Code Execution

libvorbis is vulnerable to remote code execution. The vulnerability exists when freeing uninitialized memory in the function vorbisanalysisheaderout in info.c when vi-channels=0, a similar issue to Mozilla bug 550184...

OPENSUSE-SU-2020:0597-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2020-1934: modproxyftp may use uninitialized memory when proxying to a malicious FTP server bsc1168404. - CVE-2020-1927: modrewrite configurations vulnerable to open redirect bsc1168407. - CVE-2020-1938: modproxyajp: Add 'secret' parameter...

EulerOS Virtualization for ARM 64 3.0.2.0 : httpd (EulerOS-SA-2020-1552)

According to the versions of the httpd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2020-1552)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 Security Update : apache2 (SUSE-SU-2020:1126-1)

This update for apache2 fixes the following issues : CVE-2020-1934: modproxyftp may use uninitialized memory when proxying to a malicious FTP server bsc1168404. CVE-2020-1927: modrewrite configurations vulnerable to open redirect bsc1168407. CVE-2020-1938: modproxyajp: Add 'secret' parameter to...

SUSE-SU-2020:1126-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2020-1934: modproxyftp may use uninitialized memory when proxying to a malicious FTP server bsc1168404. - CVE-2020-1927: modrewrite configurations vulnerable to open redirect bsc1168407. - CVE-2020-1938: modproxyajp: Add 'secret' parameter...

CentOS 6 : thunderbird (RHSA-2020:1488)

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1488 advisory. - Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after- free. We are aware of targeted attacks in t...

SUSE-SU-2020:1111-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2020-1934: modproxyftp may use uninitialized memory when proxying to a malicious FTP server bsc1168404. - CVE-2020-1927: modrewrite configurations vulnerable to open redirect bsc1168407. - CVE-2020-1938: modproxyajp: Add 'secret' parameter...

The vulnerability of the TIFFReadRGBAImageOriented function in the Evince document viewing software allows a hacker to gain unauthorized access to information.

The vulnerability of the TIFFReadRGBAImageOriented function in the Evince document viewing software is related to the use of uninitialized memory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to information...

Scientific Linux Security Update : poppler and evince on SL7.x x86_64 (20200407)

poppler: integer overflow in Parser::makeStream in Parser.cc poppler: heap-based buffer over-read in function PSOutputDev::checkPageSlice in PSOutputDev.cc poppler: heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc poppler: integer overflow in JPXStream::init function leading to...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20200416)

Security Fixes : - Mozilla: Use-after-free while running the nsDocShell destructor CVE-2020-6819 - Mozilla: Use-after-free when handling a ReadableStream CVE-2020-6820 - Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method CVE-2020-6821 - Mozilla: Memory safety...

Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method

The Mozilla Foundation Security Advisory describes this flaw as: When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially...

Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method

The Mozilla Foundation Security Advisory describes this flaw as: When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially...

Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method

The Mozilla Foundation Security Advisory describes this flaw as: When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially...

Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method

The Mozilla Foundation Security Advisory describes this flaw as: When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially...

MGASA-2020-0170 Updated thunderbird packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Use-after-free while running the nsDocShell destructor. CVE-2020-6819 Use-after-free when handling a ReadableStream. CVE-2020-6820 Uninitialized memory could be read when using the WebGL copyTexSubImage method. CVE-2020-6821 Out of bounds write i...