SUSE CVE-2023-44452

Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visi...

Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

cbt-tenis.com.br Cross Site Scripting vulnerability OBB-3294638

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

[Important] [Security] Virtuozzo ReadyKernel patch 149.1 for Virtuozzo Hybrid Server 7.5

The cumulative Virtuozzo ReadyKernel patch was updated with security fixes. The patch applies to all supported kernels of Virtuozzo Hybrid Server 7.5. Vulnerability id: PSBM-142895 3.10.0-1160.21.1.vz7.174.13 to 3.10.0-1160.53.1.vz7.185.3 netfilter: core: Improper NAT hooks collision check...

Kernel update: Virtuozzo ReadyKernel patch 108.0 for Virtuozzo 7.0, Virtuozzo Infrastructure Platform 2.5, 3.0, Virtuozzo Hybrid Infrastructure 3.5

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to all supported kernels of Virtuozzo 7.0, Virtuozzo Infrastructure Platform, Virtuozzo Hybrid Infrastructure. Vulnerability id: PSBM-104517 3.10.0-862.20.2.vz7.73.24 to 3.10.0-1062.12.1.vz7.131.10 ext4...

Huawei EulerOS: Security Advisory for evince (EulerOS-SA-2017-1221)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows OS is stuck on boot screen after Veeam CBT driver is installed

Challenge The Microsoft Windows OS is stuck on the boot screen after the Veeam CBT driver is installed. Cause The issue occurs if you have the Veritas System Recovery software installed on the Veeam Agent machine. The Veeam CBT driver is incompatible with the VTrack driver provided by Veritas...

cbt.center Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1013050 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting cbt.center website and it...

Veeam Agent for Microsoft Windows CBT driver installation fails with "Unable to install Veeam change block tracking driver: Microsoft Windows Security Update KB3033929 is missing."

Challenge When attempting to deploy or install the Veeam CBT driver on a machine running Windows Server 2008 R2 SP1, the following error occurs: Microsoft Windows Security Update KB3033929 is missing Copy When attempting to install the Veeam CBT Driver for a standalone Veeam Agent for Microsoft...

Evince - CBT File Command Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/zip' class MetasploitModule 'Evince CBT File Command Injection', 'Description' = %q This module exploits a command injection vulnerability in Evince before...

Evince CBT File Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/zip' class MetasploitModule 'Evince CBT File Command Injection', 'Description' = %q This module exploits a command injection vulnerability in Evince before...

Evince CBT File Command Injection

This module exploits a command injection vulnerability in Evince before version 3.24.1 when opening comic book .cbt files. Some file manager software, such as Nautilus and Atril, may allow automatic exploitation without user interaction due to thumbnailer preview functionality. Note that limited...

The vulnerability of the Evince document viewing software lies in its inability to eliminate special elements, allowing a perpetrator to execute arbitrary commands.

The vulnerability of the Evince document viewing software backend/comics/comics-document.c is related to the failure to eliminate special elements used in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially prepared a.cbt file, which is...

SUSE SLED12 / SLES12 Security Update : evince (SUSE-SU-2017:3428-1)

This update for evince fixes the following issues: Security issue fixed : - CVE-2017-1000083: Remove support for tar and tar-like commands in comics backend bsc1046856. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenab...

EulerOS 2.0 SP2 : evince (EulerOS-SA-2017-1222)

According to the version of the evince packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar CBT files, thereby allowing command...

DEBIAN-CVE-2017-1000083

backend/comics/comics-document.c aka the comic book backend in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a...

evince security update

CentOS Errata and Security Advisory CESA-2017:2388 An update for evince is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

FreeBSD : evince and atril -- command injection vulnerability in CBT handler (01a197ca-67f1-11e7-a266-28924a333806)

GNOME reports : The comic book backend in evince 3.24.0 and earlier is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened. The same vulnerability affects atril, the Evince fork. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : evince on SL7.x x86_64 (20170802)

Security Fixes : - It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar CBT files, thereby allowing command injection. A specially crafted CBT file, when opened by evince or evince- thumbnailer, could execute arbitrary commands in the context of...

Updated atril packages fix security vulnerability

It was discovered that Atril made insecure use of tar when opening tar comic book archives CBT. Opening a malicious CBT archive could result in the execution of arbitrary code. This update disables the CBT format entirely CVE-2017-1000083...