Immunity Canvas: FIREFOX_APPENDCHILD

Name| firefoxappendchild ---|--- CVE| CVE-2010-3765 Exploit Pack| CANVAS Description| firefoxappendchild Notes| CVE Name: CVE-2010-3765 VENDOR: Mozilla Notes: Interleaving document.write and appendChild can lead to duplicate text frames and overrunning of text run buffers. This exploit can only b...

Immunity Canvas: ADOBE_SHOCKWAVE_RCSLCHUNK

Name| adobeshockwavercslchunk ---|--- CVE| CVE-2010-3653 Exploit Pack| CANVAS Description| adobeshockwavercslchunk Notes| CVE Name: CVE-2010-3653 Vendor: Adobe Notes: This exploit can only be used from clientd. Tested on: Windows XP Professional SP3 EN with IE 7. Windows XP Home SP3 EN with IE7...

CVE-2010-4046

Opera before 10.63 does not properly verify the origin of video content, which allows remote attackers to obtain sensitive information by using a video stream as HTML5 canvas content...

Information disclosure

Opera before 10.63 does not properly verify the origin of video content, which allows remote attackers to obtain sensitive information by using a video stream as HTML5 canvas content...

CVE-2010-4046

Opera before 10.63 does not properly verify the origin of video content, which allows remote attackers to obtain sensitive information by using a video stream as HTML5 canvas content...

Immunity Canvas: MS_KBLAYOUT

Name| mskblayout ---|--- CVE| CVE-2010-2744 Exploit Pack| CANVAS Description| MSKBLAYOUT Notes| CVE Name: CVE-2010-2744 VENDOR: Microsoft Notes: This is one of the vulnerabilities used by the Stuxnet work to elevate its privileges on Windows XP and Windows 2000. It may cause some minor side effec...

Private video streams can be intercepted

Video content may be used as filler content for a HTML5 canvas, if the video format is natively supported by Opera. If the video and page are from the same site, the content of the canvas can be safely read out by scripts. In some cases, Opera does not check the video's origin correctly, and may...

Private video streams can be intercepted – Opera Security Advisories

Private video streams can be intercepted – Opera Security Advisories OPCOM Team | October 6, 2010 Severity Moderate Description Video content may be used as filler content for a HTML5 canvas, if the video format is natively supported by Opera. If the video and page are from the same site, the...

Immunity Canvas: MS10_061

Name| ms10061 ---|--- CVE| CVE-2010-2729 Exploit Pack| CANVAS Description| Microsoft Windows Print Spooler Arbitrary File Creation Notes| CVE Name: CVE-2010-2729 VENDOR: Microsoft MSADV: MS10-061 Repeatability: Note: Please refer to the Microsoft URLs to know exactly the conditions for when this...

Immunity Canvas: FLASH_WILD2

Name| flashwild2 ---|--- CVE| CVE-2010-2884 Exploit Pack| CANVAS Description| Flash 0day CVE-2010-2884 Notes| CVE Name: CVE-2010-2884 VENDOR: Adobe VersionsAffected: Repeatability: Date public: Not public/0day CVE Url: CVSS: 9.3...

MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) (EMERALDTHREAD)

The version of the Print Spooler service on the remote Windows host is affected by a service impersonation vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code on a Windows XP system to escalate privileges on all other supported Windows systems. EMERALDTHREAD is...

Immunity Canvas: CVE_2010_1807

Name| CVE20101807 ---|--- CVE| CVE-2010-1807 Exploit Pack| CANVAS Description| Android 2.0/2.1 webkit parsefloat Notes| CVE Name: CVE-2010-1807 VENDOR: Google Repeatability: Infinite client side - no crash References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1807 CVE Url:...

Immunity Canvas: ACROBAT_TTF_SING

Name| acrobatttfsing ---|--- CVE| CVE-2010-2883 Exploit Pack| CANVAS Description| Acrobat Reader TTF Bug Notes| CVE Name: CVE-2010-2883 Notes: VersionsAffected: Acrobat Reader = 9.3.4 Repeatability: References: http://contagiodump.blogspot.com/2010/09/cve-david-leadbetters-one-point-lesson.html...

Immunity Canvas: QUICK_PUNK

Name| quickpunk ---|--- CVE| CVE-2010-1818 Exploit Pack| CANVAS Description| quickpunk Notes| CVE Name: CVE-2010-1818 VENDOR: Apple Notes: Abyssec 0day VersionsAffected: 7.6.5 Repeatability: Infinite References: 'http://zerodayinitiative.com/advisories/ZDI-10-168/' CVE Url:...

Immunity Canvas: TRENDMICRO_SETOWNED

Name| trendmicrosetowned ---|--- CVE| CVE-2010-3189 Exploit Pack| CANVAS Description| trendmicrosetowned Notes| CVE Name: CVE-2010-3189 VENDOR: Trend Micro Notes: abyssec 0day VersionsAffected: Last Repeatability: Infinite References: 'None' CVE Url: https://vulners.com/cve/CVE-2010-3189 Date...

CVE-2010-3019

Heap-based buffer overflow in Opera before 10.61 allows remote attackers to execute arbitrary code or cause a denial of service application crash or hang via vectors related to HTML5 canvas painting operations that occur during the application of transformations...

Heap overflow

Heap-based buffer overflow in Opera before 10.61 allows remote attackers to execute arbitrary code or cause a denial of service application crash or hang via vectors related to HTML5 canvas painting operations that occur during the application of transformations...

CVE-2010-3019

CVE-2010-3019 refers to a heap-based buffer overflow in Opera prior to 10.61. The overflow occurs in HTML5 canvas painting during application of transformations, allowing a remote attacker to execute arbitrary code or cause a denial of service (application crash/hang). Multiple connected advisori...

FreeBSD : opera -- multiple vulnerabilities (71273c4d-a6ec-11df-8a8d-0008743bf21a)

The Opera Destkop Team reports : - Fixed an issue where heap buffer overflow in HTML5 canvas could be used to execute arbitrary code, as reported by Kuzzcc. - Fixed an issue where unexpected changes in tab focus could be used to run programs from the Internet, as reported by Jakob Balle and Sven...

Opera Update Closes Severe Heap Overflow Hole

Opera Software has released version 10.61 of the Opera web browser to fix a high severity hole. The issue was a heap overflow in the HTML5 canvas when performing some painting operations, which could in some cases be used to execute code. Read the full article. The H Security...