ZDI-12-004 : Apple Quicktime JPEG2000 COD Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-004 : Apple Quicktime JPEG2000 COD Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-004 January 5, 2012 - -- CVE ID: CVE-2011-3250 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Apple - -...

Updated: IE6 Market Share Dips Below 1% in US. Microsoft Celebrates

Recent data shows that the share of Web traffic in the U.S. that’s being viewed on the troubled Internet Explorer Version 6 browser has finally dropped beneath 1%, and nobody is happier about it than parent company, Microsoft, which launched a program to eradicate IE6 back in March, 2011. In a bl...

ColdFusion Zero day vulnerability : Remote File Disclosure of Password Hashes

ColdFusion Zero day vulnerability : Remote File Disclosure of Password Hashes Yesterday Blackhatacademy Released Fully automated MySQL5 boolean based enumeration tool. Today Another post expose the most critical ColdFusion vulnerability affects about a tenth of all ColdFusion servers at the...

ZDI-11-350 : Enterasys NetSight nssyslogd PRI Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-350 : Enterasys NetSight nssyslogd PRI Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-350 December 19, 2011 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors: Enterasys - --...

ZDI-11-354 : HP Managed Printing Administration jobDelivery Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-354 : HP Managed Printing Administration jobDelivery Multiple Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-11-354 December 22, 2011 - -- CVE ID: CVE-2011-4168 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors:...

nsSVGValue out-of-bounds access — Mozilla

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler...

Adobe to Patch Reader Zero Day on Friday

Adobe plans to release a patch on Friday for the zero-day vulnerability in its Reader and Acrobat applications on Windows that is currently being used in some targeted attacks. The patches for the applications running on other platforms will be released next month during the next scheduled patch...

Microsoft Patches Windows Flaw Exploited by Duqu

Microsoft on Tuesday released 13 security bulletins, including three for critical flaws in Windows Media and in the Windows kernel-mode drivers. The company had planned on releasing 14 bulletins in December’s Patch Tuesday shipment, but officials said that one of the planned fixes was causing a...

SuSE 10 Security Update : Mozilla XULrunner (ZYPP Patch Number 7492)

Mozilla XULRunner 1.9.1 was updated to the 1.9.1.19 security release. - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, a...

More Details of Sykipot Exploits Of Adobe Reader Flaw Surface

More evidence is beginning to emerge that the Adobe Reader zero-day bug revealed recently is being used in targeted attacks against companies and federal agencies. Researchers recently have come across fresh samples of malware exploiting the vulnerability by using files crafted to draw in employe...

Attackers Using Known Trojan in Exploits on Adobe Zero Day

The newly discovered vulnerability in Adobe Reader and Acrobat that the company is planning to patch next week is being used to install a known Trojan that has been used in attacks against other Adobe vulnerabilities in the past. Researchers who have analyzed the payload of the attacks against th...

Critical Zero-day Vulnerability in Adobe Reader

Critical Zero-day Vulnerability in Adobe Reader Researchers at the Lockheed Martin Computer Incident Response Team CRT and members of the Defense Security Information Exchange informed Adobe that their products were being exploited by hackers. The exploit affects all versions of Adobe Reader and...

Critical Zero-day Vulnerability in Adobe Reader

Critical Zero-day Vulnerability in Adobe Reader Researchers at the Lockheed Martin Computer Incident Response Team CRT and members of the Defense Security Information Exchange informed Adobe that their products were being exploited by hackers. The exploit affects all versions of Adobe Reader and...

Adobe Zero-Day Targets Lockheed Martin

Adobe said a previously undisclosed vulnerability in its Reader and Acrobat applications was passed along by defense contractor Lockheed Martin, raising the specter of a targeted attack on the important military supplier. In issuing a warning about a critical flaw on Tuesday, Adobe credied both...

Adobe Warns of Critical Zero-Day Flaw in Reader and Acrobat

Adobe is warning users about a critical vulnerability in its Reader and Acrobat applications that could lead to remote code execution. There are reports that attackers already are using the Reader bug in targeted attacks, and Adobe said it plans to have a patch ready by next week. Adobe security...

Mozilla Firefox 3.6.23 - Z0D Code Execution Vulnerability

Document Title: =============== Mozilla Firefox 3.6.23 - Z0D Code Execution Vulnerability References: =========== Download: http://www.vulnerability-lab.com/resources/videos/329.wmv View: http://www.youtube.com/watch?v=oTx1QP2Msg Release Date: ============= 2011-12-03 Vulnerability Laboratory ID...

Symantec Alert Management System AMSSendAlertAck Buffer Overflow

Added: 12/01/2011 CVE: CVE-2010-0110 BID: 45936 OSVDB: 72623 Background The Symantec Alert Management System 2 AMS2 is used by multiple Symantec products. It includes an Intel Alert Handler service hndlrsvc.exe. This service handles messages forwarded to it by the Alert Originator Manager...

Symantec Alert Management System AMSSendAlertAck Buffer Overflow

Added: 12/01/2011 CVE: CVE-2010-0110 BID: 45936 OSVDB: 72623 Background The Symantec Alert Management System 2 AMS2 is used by multiple Symantec products. It includes an Intel Alert Handler service hndlrsvc.exe. This service handles messages forwarded to it by the Alert Originator Manager...

How the Duqu Authors May Have Erred

Duqu has been called the spawn of Stuxnet, or maybe some sort of stepchild or second cousin. That initial analysis came from some similarities in the code of the two attack tools, and now that researchers have had more time to pull Duqu apart and see how it works, it seems more and more likely th...

ZDI-11-329 : InduSoft WebStudio CEServer Operation 0x15 Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-329 : InduSoft WebStudio CEServer Operation 0x15 Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-329 November 16, 2011 - -- CVE ID: CVE-2011-4052 - -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C - -- Affected...