Information disclosure

Metadata Anonymisation Toolkit MAT 0.6 and 0.6.1 silently fails to perform "Clean metadata" actions upon invocation from the Nautilus contextual menu, which allows context-dependent attackers to obtain sensitive information by reading a file for which cleaning had been attempted...

zlib: Big-endian out-of-bounds pointer

The crc32big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation...

zlib: Undefined left shift of negative number

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers...

zlib: Undefined left shift of negative number

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers...

Mozilla Firefox < 53 Multiple Vulnerabilities

Binary data 700065.prm...

Default credentials

In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent attackers to obtain sensitive information by reading the .xml dotfile...

Google Chrome < 57.0.2987.133 Multiple Vulnerabilities

Binary data 700054.pasl...

Safari < 10.1 Multiple Vulnerabilities

Binary data 700033.prm...

Information disclosure

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...

CVE-2017-6314

The makeavailableatleast function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service infinite loop via a large TIFF file...

ALPINE-CVE-2017-6314

The makeavailableatleast function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service infinite loop via a large TIFF file...

CVE-2017-6314

GDK-PixBuf vulnerability CVE-2017-6314 concerns the make_available_at_least function in io-tiff.c. A context-dependent attacker can trigger an infinite loop by feeding a large TIFF file, causing a denial of service. The issue is in the gdk-pixbuf image loading library and affects TIFF handling. M...

Mozilla Firefox ESR < 45.7 Multiple Vulnerabilities

Binary data 9928.prm...

CVE-2016-6602

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit...

CVE-2016-4338

The mysql user parameter configuration script userparametermysql.conf in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size paramete...

CVE-2015-8972

Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess aka gnuchess before 6.2.4 might allow context-dependent attackers to execute arbitrary code via a large input, as demonstrated when in UCI mode...

Mozilla Firefox < 50.1 Multiple Vulnerabilities

Binary data 9851.prm...

CVE-2016-3684

SAP Download Manager 2.1.142 and earlier uses a hardcoded encryption key to protect stored data, which allows context-dependent attackers to obtain sensitive configuration information by leveraging knowledge of this key, aka SAP Security Note 2282338...

CVE-2016-9480

CVE-2016-9480 affects libdwarf, specifically the dwarf_util.c path, where a heap-based over-read vulnerability in a malformed DWARF file can lead to information disclosure or a denial of service. The issue is described as a Heap Buffer Over-read (DW201611-006) and is referenced in upstream adviso...

Updated tre packages fix security vulnerability

The TRE library allows context-dependent attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted regular expression CVE-2015-3796. A vulnerability has been found in the tre package that could allow an attacker to perform controlled he...