CVE-2017-8250

In all Qualcomm products with Android releases from CAF using the Linux kernel, user controlled variables "nrcmds" and "nrbos" number are passed across functions without any check. An integer overflow to buffer overflow with a smaller buffer allocated may occur when they are too large or negative...

Microsoft Windows Kernel - nt!NtSetIoCompletion nt!NtRemoveIoCompletion Pool Memory Disclosure

Microsoft Windows Kernel - nt!NtSetIoCompletion nt!NtRemoveIoCompletion Pool Memory Disclosure / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1269 We have discovered that the nt!NtRemoveIoCompletion system call handler discloses 4 bytes of uninitialized pool memory to user-mo...

Design/Logic Flaw

In Apple iOS 7 through 9, due to a BlueBorne flaw in the implementation of LEAP Low Energy Audio Protocol, a large audio command can be sent to a targeted device and lead to a heap overflow with attacker-controlled data. Since the audio commands sent via LEAP are not properly validated, an attack...

kernel: a race between inotify_handle_event() and sys_rename()

A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotifyhandleevent and vfsrename while running the rename operation against the same file. As a result of the race the next slab data or the slab's free list pointer can be...

Design/Logic Flaw

An exploitable code execution vulnerability exists in the image rendering functionality of Lexmark Perceptive Document Filters 11.3.0.2400. A specifically crafted PDF can cause a function call on a corrupted DCTStream to occur, resulting in user controlled data being written to the stack. A...

CVE-2017-2822

An exploitable code execution vulnerability exists in the image rendering functionality of Lexmark Perceptive Document Filters 11.3.0.2400. A specifically crafted PDF can cause a function call on a corrupted DCTStream to occur, resulting in user controlled data being written to the stack. A...

CVE-2017-2822

An exploitable code execution vulnerability exists in the image rendering functionality of Lexmark Perceptive Document Filters 11.3.0.2400. A specifically crafted PDF can cause a function call on a corrupted DCTStream to occur, resulting in user controlled data being written to the stack. A...

kernel: a race between inotify_handle_event() and sys_rename()

A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotifyhandleevent and vfsrename while running the rename operation against the same file. As a result of the race the next slab data or the slab's free list pointer can be...

Format string

An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.220170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute arbitrary code...

CVE-2017-12702

CVE-2017-12702 affects Advantech WebAccess prior to version V8.2_20170817. The issue is an Externally Controlled Format String (CWE-134): string format specifiers based on user input are not properly validated, potentially enabling arbitrary code execution. The vulnerability is associated with th...

CVE-2017-10952

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.0.2051. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the save...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20170815)

Security Fixes : - A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotifyhandleevent and vfsrename while running the rename operation against the same file. As a result of the race the next slab data or the slab's free li...

CVE-2016-5867

CVE-2016-5867 affects the Qualcomm sound driver in Android MSM (kernel sound subsystem). The root cause is that some variables originate from userspace and can be chosen to trigger a stack overflow, potentially enabling local impact. The initial description notes a stack overflow risk; CVSS3/2 me...

CVE-2017-8271

Out of bound memory write can happen in the MDSS Rotator driver in all Qualcomm products with Android releases from CAF using the Linux kernel by an unsanitized userspace-controlled parameter...

CVE-2017-8269

Userspace-controlled non null terminated parameter for IPA WAN ioctl in all Qualcomm products with Android releases from CAF using the Linux kernel can lead to exposure of kernel memory...

Brave Software: application/x-brave-tab should not be readable.

Summary: It is possible to read a dragged tab object if user is coerced into drag and dropping it into attacker controlled page. This is bad because tab history is mentioned within the object, thus information leaks are possible through a trick. Products affected: Brave: 0.18.14 rev:...

Kernel security update: CVE-2017-7533; Virtuozzo ReadyKernel patch 28.0 for Virtuozzo 7.0.x

The cumulative Virtuozzo ReadyKernel patch was updated with a security fix. The patch applies to Virtuozzo kernels 3.10.0-327.18.2.vz7.15.2 Virtuozzo 7.0.0, 3.10.0-327.36.1.vz7.18.7 Virtuozzo 7.0.1, 3.10.0-327.36.1.vz7.20.18 Virtuozzo 7.0.3, 3.10.0-514.16.1.vz7.30.10 Virtuozzo 7.0.4,...

SLiMS Cross-Site Request Forgery Vulnerability

SLiMS 8 Akasia is an open source, free library management system. A security vulnerability exists in SLiMS 8 Akasia 8.3.1 and earlier versions. A remote attacker can leverage the 'passwd1' and 'passwd2' in the admin/modules/system/appuser.php changecurrent=true operation to trick users into...

CVE-2017-11135

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism does not check for authorization. Therefore, an attacker only needs to know the device ID. This causes a denial of service. This might be...

Authorization

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism does not check for authorization. Therefore, an attacker only needs to know the device ID. This causes a denial of service. This might be...