SSL/TLS CRIME attack against HTTPS

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differenc...

DEBIAN-CVE-2014-2744

plugins/modcompression.lua in 1 Prosody before 0.9.4 and 2 Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service resource consumption via compressed XML elements in an XMPP stream, aka an...

CVE-2014-2744

plugins/modcompression.lua in 1 Prosody before 0.9.4 and 2 Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service resource consumption via compressed XML elements in an XMPP stream, aka an...

Design/Logic Flaw

plugins/modcompression.lua in 1 Prosody before 0.9.4 and 2 Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service resource consumption via compressed XML elements in an XMPP stream, aka an...

CVE-2014-2744

plugins/modcompression.lua in 1 Prosody before 0.9.4 and 2 Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service resource consumption via compressed XML elements in an XMPP stream, aka an...

CVE-2014-2744

plugins/modcompression.lua in 1 Prosody before 0.9.4 and 2 Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service resource consumption via compressed XML elements in an XMPP stream, aka an...

CVE-2014-2744

plugins/modcompression.lua in 1 Prosody before 0.9.4 and 2 Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service resource consumption via compressed XML elements in an XMPP stream, aka an...

MaraDNS 0.5.x < 0.5.31 / 0.9.x < 0.9.01 Compression Code Remote DoS

According to its self-reported version number, the MaraDNS server running on the remote host is affected by a memory leak issue due to the compression code. This issue could allow a remote attacker to cause a remote denial of service by sending a specially crafted DNS packet. C Tenable Network...

Debian Security Advisory DSA 2895-1 (prosody - security update)

A denial-of-service vulnerability has been reported in Prosody, a XMPP server. If compression is enabled, an attacker might send highly-compressed XML elements attack known as zip bomb over XMPP streams and consume all the resources of the server. The SAX XML parser lua-expat is also affected by...

[SECURITY] [DSA 2895-1] prosody security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2895-1 [email protected] http://www.debian.org/security/ Luciano Bello April 06, 2014 http://www.debian.org/security/faq -...

Internet Bug Bounty: Uncontrolled Resource Consumption with XMPP-Layer Compression

The bug information described below is based on a publicly available security notice here http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ These discoveries are part of the results of my research activities. OVERVIEW...

Debian: Security Advisory (DSA-2895-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Autodesk SketchBook Pro PSD通道RLE解压缓冲区溢出漏洞

Bugtraq ID:66563 CVE ID:CVE-2013-5365 Autodesk SketchBook Pro是速写簿软件。 Autodesk SketchBook Pro解压PSD文件内的RLE压缩通道数据时存在边界错误，这可使远程攻击者通过特制的PSD文件，利用此漏洞造成堆缓冲区溢出。 0 Autodesk SketchBook Pro 6.2.4 build 425798 for Windo 目前厂商已经发布了升级补丁以修复漏洞，请下载使用：...

Fedora Update for lighttpd FEDORA-2014-3887

Check for the Version of lighttpd OpenVAS Vulnerability Test Fedora Update for lighttpd FEDORA-2014-3887 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CVE-2013-5365

Autodesk SketchBook vulnerability CVE-2013-5365 is a heap-based buffer overflow in affected SketchBook variants (Enterprise 2014, Pro, Express before 6.25; Copic Edition before 2.0.2). The flaw occurs while decompressing RLE-compressed channel data in PSD files, enabling remote code execution. Re...

Adobe Photoshop Tiff File RLE Compression Buffer Overflow - Ver2 (CVE-2012-2027)

A buffer overflow vulnerability has been reported in Adobe Photoshop. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Updated plexus-archiver package fixes security vulnerability

Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream BZip2CompressorOutputStream in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service CPU consumption via a file with many repeating inputs CVE-2012-2098. plexus-archiver...

Fedora Update for openjpeg FEDORA-2014-0719

Check for the Version of openjpeg OpenVAS Vulnerability Test Fedora Update for openjpeg FEDORA-2014-0719 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Advanced File Binder: Rakabulle

Advanced File Binder from DarkComet RAT Developer Rakabulle in one word is a file binder from DarkComet RAT Developer with few novel features which could transform a simple binder program to something very complex. What is a file binder? In few words a file binder is a tiny tool which allows...

[PeStudio v7.98] The Static Investigation tool for Windows executable binary

PeStudio is a free tool performing the static investigation of any Windows executable binary. A file being analyzed with PeStudio is never launched. Therefore you can evaluate unknown executable and even malware with no risk. PeStudio runs on any Windows Platform and is fully portable , no...