Kaspersky Security Bulletin: Review of the Year 2017

Introduction The end of the year is a good time to take stock of the main cyberthreat incidents that took place over the preceding 12 months or so. To reflect on the impact these events had on organizations and individuals, and consider what they could mean for the overall evolution of the threat...

Adobe Flash Player Read Across Boundaries Vulnerability (CNVD-2017-37122)

Adobe Flash Player is a cross-platform, browser-based multimedia player product from Adobe. The product supports cross-screen and browser viewing of applications, content and videos. A security vulnerability exists in Adobe Flash Player. A remote attacker could exploit this vulnerability to execu...

Google Chrome V8 Denial of Service Vulnerability (CNVD-2017-33055)

Google Chrome is the United States Google Google company developed a Web browser. v8 is one of the open source JavaScript engine. A security vulnerability exists in Google Chrome V8. An attacker can exploit this vulnerability to cause a denial of service read across boundaries...

ACLU Attorney: U.S. Citizens Legally Unsheltered from Abusive Surveillance

U.S. law has failed to protect Americans from widespread and excessive surveillance, a dire situation that requires immediate attention from citizens, lawmakers, attorneys, privacy experts and the courts. That was the urgent warning Jennifer S. Granick, Surveillance and Cybersecurity Counsel at t...

WPA2 vulnerability flaws bug the principles of research and prevention（WIPS product against KRACK vulnerability-vulnerability warning-the black bar safety net

Media In recent days, a network security researcher revealed WPA2 agreement layer in the presence of the logical shortcomings, nearly all support Wi-Fi equipment have to face the intimidating, the transmission of data there is sniffing, tampering risk. Intrusion the attacker can obtain WiFi data...

GLSA-201710-16 : Shadow: Buffer overflow

The remote host is affected by the vulnerability described in GLSA-201710-16 Shadow: Buffer overflow Malformed input in the newusers tool may produce crashes and other unspecified behaviors. Impact : A remote attacker could possibly cause a Denial of Service condition or bypass privilege boundari...

Heap overflow

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name longer than about 515 bytes, the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used...

Micro Focus VisiBroker Read Across Boundaries Vulnerability

Micro Focus VisiBroker is a CORBA environment for developing, deploying and managing distributed applications from Micro Focus, UK. An out-of-bounds read vulnerability exists in Micro Focus VisiBroker version 8.5. No information about this vulnerability is available at this time...

Moxa AWK-3131A serviceAgent Information Disclosure Vulnerability(CVE-2016-8724)

Summary An exploitable information disclosure vulnerability exists in the serviceAgent functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted TCP query will allow an attacker to retrieve potentially sensitive information. Tested Versions Moxa AWK-3131A...

VMware ESXi Out-of-Bounds Write Code Execution Vulnerability

VMware ESXi is a server virtualization platform that can be installed directly on physical servers. A security vulnerability exists in VMware ESXi that could be exploited by a remote attacker to submit a special request to write and execute arbitrary code across boundaries...

The vulnerability of the ReadWEBPImage function (coders/webp.c) in the console-based image editing tool ImageMagick allows a hacker to trigger a memory leak.

The vulnerability of the ReadWEBPImage function coders/webp.c in the console-based image editing tool ImageMagick arises from the execution of an operation outside the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to trigger a memory leak from a remote...

The vulnerability in the application for the Android camera driver from the CAF repository, which allows a intruder to trigger a reread of dynamic memory buffers.

The vulnerability in the Android camera driver application from the CAF repository arises from an operation that goes beyond the buffer boundaries in memory when processing the frame/command component with invalid values. Exploiting this vulnerability allows a remote attacker to trigger the...

The vulnerability of the ReadOneMNGImage function in the console-based ImageMagick graphics editor allows a hacker to perform read operations beyond the memory limit.

The vulnerability of the ReadOneMNGImage function in the coder/png.c file of the console image editing tool ImageMagick arises from reading data beyond the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to read data beyond the memory limit of the MNG CLIP section...

The vulnerability of the get_subexp function in the uClibc library, which allows a perpetrator to perform read operations beyond the buffer boundaries.

The vulnerability of the getsubexp function in the uClibc library is related to the processing of regular expressions. Exploiting this vulnerability allows a remote attacker to perform out-of-memory reading using a specially crafted regular expression...

Liblouis Read Across Boundaries Vulnerability

Liblouis is an open-source Braille translator written in C. It can be used to translate Braille into other languages. An out-of-bounds read vulnerability exists in the 'lougetALine' function of compileTranslationTable.c:343 in Liblouis version 3.2.0. A remote attacker could exploit this...

The vulnerability of the Microsoft Edge browser’s scripting engine, allowing a hacker to execute arbitrary code

The vulnerability of the Microsoft Edge browser’s scripting engine arises from an operation that goes beyond the buffer boundaries in memory a memory corruption that occurs when working with objects in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the...

The vulnerability in the JavaScript kernel of Microsoft Edge allows a hacker to execute arbitrary code.

The vulnerability in the Microsoft Edge JavaScript kernel is caused by an operation going beyond the buffer boundaries in memory memory corruption due to a script error. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, as a resul...

Vulnerability of object handlers in Microsoft Edge and Internet Explorer browsers’ memory, allowing attackers to execute arbitrary code

The vulnerability of object handlers in the memory of Microsoft Edge and Internet Explorer arises from the execution of operations beyond the buffer boundaries in memory memory corruption. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the curre...

CVE-2017-1000100

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name longer than about 515 bytes, the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used...

The vulnerability of JavaScript handlers in the Microsoft Edge browser for the Windows operating system, allowing a perpetrator to execute arbitrary code

The vulnerability of Microsoft Edge’s JavaScript handlers arises from an operation going beyond the buffer boundaries due to a memory object processing error. Exploiting this vulnerability allows a remote attacker to execute arbitrary code in the context of the current user...