Google Android - Inter-Process munmap with User-Controlled Size in android.graphics.Bitmap

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=928 Bitmap objects can be passed between processes by flattening them to a Parcel in one process and un-flattening them in another. In order to conserve memory, there exists a code path which allows Bitmaps to be shared between...

OwnCloud 'file' app content spoofing vulnerability

OwnCloud is a free and open source personal cloud storage solution from OwnCloud Germany. A content spoofing vulnerability exists in the OwnCloud 'file' app due to the location bar in the file app failing to validate passed parameters, allowing an attacker to spoof a link to a fake directory...

Updated tre packages fix security vulnerability

The TRE library allows context-dependent attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted regular expression CVE-2015-3796. A vulnerability has been found in the tre package that could allow an attacker to perform controlled he...

PowerShellEmpire Arbitrary File Upload (Skywalker)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'PowerShellEmpire Arbitrary File Upload Skywalker', 'Description' = %q A vulnerability existed in the PowerShellEmpire server...

Server: Content-Spoofing in "files" app

The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user. For more information please consult the official advisory. This advisory is...

git-fastclone command execution vulnerability

git-fastclone is a set of tools for cloning git. A command execution vulnerability exists in git-fastclone versions prior to 1.0.5, which stems from a program passing a user-modified string directly to a shell command. The vulnerability can be exploited to execute malicious commands by modifying...

CVE-2016-8620

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input...

Debian DLA-687-1 : tre security update

A vulnerability has been found in the tre package that could allow an attacker to perform controlled heap corruption. For Debian 7 'Wheezy', these problems have been fixed in version 0.8.0-3+deb7u1. We recommend that you upgrade your tre packages. NOTE: Tenable Network Security has extracted the...

[SECURITY] [DLA 687-1] tre security update

Package : tre Version : 0.8.0-3+deb7u1 CVE ID : CVE-2016-8859 Debian Bug : 842169 A vulnerability has been found in the tre package that could allow an attacker to perform controlled heap corruption. For Debian 7 "Wheezy", these problems have been fixed in version 0.8.0-3+deb7u1. We recommend tha...

You Can Hijack Nearly Any Drone Mid-flight Using This Tiny Gadget

Now you can hijack nearly any drone mid-flight just by using a tiny gadget. Security researcher Jonathan Andersson has devised a small hardware, dubbed Icarus, that can hijack a variety of popular drones mid-flight, allowing attackers to lock the owner out and give them complete control over the...

DLA-687-1 tre - security update

Bulletin has no description...

LibTIFF PixarLogDecode Remote Code Execution Vulnerability

Summary An exploitable heap based buffer overflow exists in the handling of compressed TIFF images in LibTIFF’s PixarLogDecode api. A crafted TIFF document can lead to a heap based buffer overflow resulting in remote code execution. The vulnerability can be triggered through any user controlled...

Microsoft Browser Information Disclosure Vulnerability

An information disclosure vulnerability exists when affected Microsoft scripting engines do not properly handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer. In a web-based attack scenario, an attacker could host a website that is us...

Content-Spoofing in "files" app (NC-SA-2016-010)

The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user...

H2O use of externally-controlled format string

Overview H2O is an open source web server software. H2O uses externally-controlled format strings CWE-134 in the code which output error logs. Kazuho Oku reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Kazuho Oku coordinated under the Information...

Microsoft Browser Information Disclosure Vulnerability

An information disclosure vulnerability exists when affected Microsoft scripting engines do not properly handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer. In a web-based attack scenario, an attacker could host a website that is us...

Trend Micro InterScan Messaging Security Open Redirect Vulnerability

Trend Micro InterScan Messaging Security is a hybrid SaaS email security solution. Trend Micro InterScan Messaging Security suffers from an open redirection vulnerability. The vulnerability allows an attacker to be redirected to an attacker-controlled website...

HTTPD: sets environmental variable based on user supplied Proxy request header

It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could...

Cisco RV110W, RV130W, and RV215W Routers Command Shell Injection Vulnerability

A vulnerability in the command-line interface CLI command parser of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an authenticated, local attacker to inject arbitrary shell commands that are executed ...

Apple Mac OSX Kernel - Out-of-Bounds Read of Object Pointer Due to Insufficient Checks in Raw Cast to enum Type

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=774 The IOHIDFamily function IOHIDDevice::handleReportWithTime takes at attacker controlled unchecked IOHIDReportType enum, which was cast from an int in either IOHIDLibUserClient::setReport or getReport: ret =...