[SECURITY] Fedora 27 Update: ncurses-6.0-14.20170722.fc27

The curses library routines are a terminal-independent method of updating character screens with reasonable optimization. The ncurses new curses library is a freely distributable replacement for the discontinued 4.4 BSD classic curses library. This package contains support utilities, including a...

CVE-2016-10556

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped. This...

GNU Barcode 0.99 - Buffer Overflow

GNU Barcode 0.99 - Buffer Overflow Vendor: The GNU Project | Free Software Foundation, Inc. Product web page: https://www.gnu.org/software/barcode/ https://directory.fsf.org/wiki/Barcode Author: Gjoko 'LiquidWorm' Krstic Tested on: Ubuntu 16.04.4 Affected version: 0.99 Summary: GNU Barcode is a...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20180524)

This update upgrades Thunderbird to version 52.8.0. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 CVE-2018-5150 - Mozilla: Backport critical security fixes in Skia CVE-2018-5183 - Mozilla: Use-after-free with SVG animations and clip paths CVE-2018-5154 -...

odle: piping security data

I recently published odle which is a Ruby gem and binary that takes XML data from various security tools and outputs their JSON equivalent. The goal is to be 1 simple, 2 fast, and 3 work on many platforms with only one dependency - nokogiri. Below are two examples using odle to convert output fro...

Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR 52.8, Thunderbird 52.8, and...

Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR 52.8, Thunderbird 52.8, and...

Debian DSA-4203-1 : vlc - security update

Hans Jerry Illikainen discovered a type conversion vulnerability in the MP4 demuxer of the VLC media player, which could result in the execution of arbitrary code if a malformed media file is played. This update upgrades VLC in stretch to the new 3.x release series as security fixes couldn't be...

[SECURITY] [DSA 4203-1] vlc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4203-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 17, 2018 https://www.debian.org/security/faq -...

Hyland Perceptive Document Filters OpenDocument to JPEG conversion SkCanvas Code Execution vulnerability(CVE-2018-3845)

Summary An exploitable double free exists in the OpenDocument to JPEG conversion functionality of the Hyland Perspective Document Filters version 11.4.0.2647. A crafted OpenDocument document can lead to a SkCanvas object double free resulting in direct code execution. Tested Versions Perceptive...

The vulnerability of the Content Protection HECI Service driver for Intel Graphics Systems allows attackers to enhance their privileges.

The vulnerability of the Content Protection HECI Service, a driver for Intel Graphics systems, is related to type conversion errors. Exploiting this vulnerability can allow attackers to enhance their privileges...

Nanopool Claymore Dual Miner 7.3 - Remote Code Execution

Exploit Title: Nanopool Claymore Dual Miner = 7.3 Remote Code Execution Date: 2018/02/09 Exploit Author: ReverseBrain Vendor Homepage: https://nanopool.org/ Software Link: https://github.com/nanopool/Claymore-Dual-Miner Version: 7.3 and later Tested on: Windows, Linux CVE : 2018-1000049 Suppose t...

Hyland Perceptive Document Filters Microsoft Word CDATA Code Execution Vulnerability(CVE-2018-3851)

Summary An exploitable heap corruption exists in the Microsoft Word to many types conversion functionality of the Hyland Perspective Document Filters version 11.4.0.2647. A crafted Microsoft Word XML document can lead to heap corruption resulting in remote code execution. An attacker can provide ...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20180515)

This update upgrades Firefox to version 52.8.0 ESR. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 CVE-2018-5150 - Mozilla: Backport critical security fixes in Skia CVE-2018-5183 - Mozilla: Use-after-free with SVG animations and clip paths CVE-2018-5154 -...

Adobe Acrobat Pro DC ImageConversion EMF EMR_CREATEDIBPATTERNBRUSHPT Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

Significant retail spending on Mother's Day sets a stage for major holidays in 2018

The second Sunday in May is a special day for everyone because it's Mother's Day. It's also a special day for retailers, as it represents another peak period and serves as the halfway point between the prior year's Black Friday and Cyber Monday and the upcoming year's retail holidays. The retail...

Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR 52.8, Thunderbird 52.8, and...

CVE-2018-5178

A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR 52.8, Thunderbird 52.8, and...

php: Wrong calculation in exif_convert_any_to_int function

It was found that the exifconvertanytoint function in PHP was vulnerable to floating point exceptions when parsing tags in image files. A remote attacker with the ability to upload a malicious image could crash PHP, causing a Denial of Service...

Renaming Vulnerability in DedeCMS v5.7 SP2 Version

Shanghai Zhuozhuo Network Technology Co., Ltd Desdev Inc, is a professional web content management solutions provider, its products - Dream Content Management System DedeCms is one of the most used CMS in China. A renaming vulnerability exists in DedeCMS V5.7 SP2, which allows an attacker to obta...