CVE-2017-16588

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

The installer of Media Go and Music Center for PC may insecurely load Dynamic Link Libraries

Overview Media Go and Music Center for PC provided by Sony Group are file management tools. The installer of Media Go and Music Center for PC contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Eili Masami of Tachibana Lab. and Shun Suza...

CVE-2017-10615

A vulnerability in the pluggable authentication module PAM of Juniper Networks Junos OS may allow an unauthenticated network based attacker to potentially execute arbitrary code or crash daemons such as telnetd or sshd that make use of PAM. Affected Juniper Networks Junos OS releases are: 14.1 fr...

mysql: Incorrect input validation allowing code execution via mysqldump

It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database...

PT-2017-15596 · Sdl +1 · Sdl Image +1

Name of the Vulnerable Software and Affected Versions: SDL image version 2.0.1 Description: A buffer overflow vulnerability exists in the XCF property handling functionality. A specially crafted XCF file can cause a stack-based buffer overflow, potentially leading to code execution. An attacker c...

OpenJPEG lib/openjp2/j2k.c File Denial of Service Vulnerability

OpenJPEG is a C-based open source JPEG 2000 codec . A security vulnerability exists in the opjj2kwritesot of the lib/openjp2/j2k.c file in OpenJPEG version 2.2.0. A remote attacker could exploit this vulnerability to cause a denial of service heap buffer overflow or code execution...

SUSE-SU-2017:2251-1 Security update for mercurial

This update for mercurial fixes the following issues: - CVE-2017-1000115: path traversal via symlink could lead to unauthorized access bsc1053344 - CVE-2017-1000116: argument injection in SSH URLs could lead to client-side code execution bsc1052696...

Installer and self-extracting archive containing the installer of TDB CA TypeA use software may insecurely load Dynamic Link Libraries

Overview TDB CA TypeA use software provided by Teikoku Databank, Ltd. is a software which provides environment for using system and management function of TDB electronic authentication service TypeA. The installer and the self-extracting archive containing the installer of TDB CA TypeA use softwa...

SUSE-SU-2017:2105-1 Security update for python-tablib

This update for python-tablib fixes the following issues: - CVE-2017-2810: Use yaml.safeload and yaml.safedump to avoid executing code when importing data bsc1044329...

MGASA-2017-0222 Updated valgrind packages fix security vulnerabilities

It was discovered that Valgrind incorectly handled certain string operations. If a user or automated system were tricked into processing a specially crafted binary, a remote attacker could possibly execute arbitrary code CVE-2016-2226. It was discovered that Valgrind incorrectly handled parsing...

[Simeji for Windows] installer may insecurely load Dynamic Link Libraries

Overview Simeji for Windows installer provided by Baidu Japan Inc. contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Eili Masami of Tachibana Lab. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

UBUNTU-CVE-2017-1000366

glibc contains a vulnerability that allows specially crafted LDLIBRARYPATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap...

Installer of Houkokusyo Sakusei Shien Tool provided by Ministry of the Environment may insecurely load Dynamic Link Libraries

Overview Installer of Houkokusyo Sakusei Shien Tool provided by Ministry of the Environment contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Eili Masami of Tachibana Lab. and BlackWingCat of Pink Flying Whale reported this vulnerability to...

RW-5100 driver installer may insecurely load Dynamic Link Libraries

Overview RW-5100 driver installer for IC Card Reader/Writer devices provided by Sharp Corporation contains an issue with the DLL search path, which may lead to insecurely load Dynamic Link Libraries CWE-427. Yuji Tounai of NTT Communications Corporation and BlackWingCat of PinkFlyingWhale reporte...

SUSE-SU-2017:1092-1 Security update for minicom

This update for minicom fixes the following issue: This security issue was fixed: - CVE-2017-7467: Invalid cursor coordinates and scroll regions could lead to code execution bsc1033783...

Memory Corruption Vulnerability in PSD Image Processing by Universal Viewer

Universal Picture Viewer is an image viewing tool. Universal Picture Viewer has a memory corruption vulnerability when dealing with PSD format images, which allows an attacker to construct a malformed PSD format that can cause the program to crash, and if successfully exploited, can lead to...

PT-2017-1939

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description The issue exists due to insufficient input validation in the SMBv1 protocol of the Microsoft Windows operating system. It allows a remote attacker to execute arbitrary code using...

PT-2017-9652 · Iceni · Iceni Argus

Name of the Vulnerable Software and Affected Versions: Iceni Argus affected versions not specified Description: An exploitable heap-based buffer overflow exists in the software. When it attempts to convert a PDF containing a malformed font to XML, the tool will attempt to use a size out of the fo...

Iceni Argus PDF Font-Encoding GlyphMap Adjustment Code Execution Vulnerability

Summary An exploitable arbitrary heap-overwrite vulnerability exists within Iceni Argus. When it attempts to convert a malformed PDF to XML, it will explicitly trust an index within the specific font object and use it to write the font’s name to a single object within an array of objects. Due to ...

CVE-2016-4338

The mysql user parameter configuration script userparametermysql.conf in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size paramete...