DEBIAN-CVE-2017-10685

In ncurses 6.0, there is a format string vulnerability in the fmtentry function. A crafted input will lead to a remote arbitrary code execution attack...

UBUNTU-CVE-2017-10685

In ncurses 6.0, there is a format string vulnerability in the fmtentry function. A crafted input will lead to a remote arbitrary code execution attack...

CVE-2017-10683

In mpg123 1.25.0, there is a heap-based buffer over-read in the convertlatin1 function in libmpg123/id3.c. A crafted input will lead to a remote denial of service attack...

Huawei Vicky-AL00A and Victoria-AL00A cell phones isub denial of service vulnerability

The Huawei Vicky-AL00A and Victoria-AL00A are both smartphone devices from the Chinese company Huawei Huawei. A denial of service vulnerability exists in the lsub service in the Huawei Vicky-AL00A Vicky-AL00AC00B157 prior and Victoria-VL00A Victoria-VL00AC00B157 prior, which stems from a program...

CVE-2017-10688

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tifdirwrite.c. A crafted input will lead to a remote denial of service attack...

CVE-2017-9987

There is a heap-based buffer overflow in the function hpelmotion in mpegvideomotion.c in libav 12.1. A crafted input can lead to a remote denial of service attack...

libming 'readEncUInt30' function denial of service vulnerability

libming is a Flash SWF output library written in C for use in systems developed in PHP, Perl, etc. It can be used to output Flash SWF files to the system. A security vulnerability exists in the 'readEncUInt30' function in the util/read.c file in libming version 0.4.8, which stems from a failure o...

CVE-2017-9953

There is an invalid free in Image::printIFDStructure that leads to a Segmentation fault in Exiv2 0.26. A crafted input will lead to a remote denial of service attack...

PYSEC-2017-142

There is an invalid free in Image::printIFDStructure that leads to a Segmentation fault in Exiv2 0.26. A crafted input will lead to a remote denial of service attack...

Design/Logic Flaw

There is an invalid free in Image::printIFDStructure that leads to a Segmentation fault in Exiv2 0.26. A crafted input will lead to a remote denial of service attack...

CVE-2017-9953

There is an invalid free in Image::printIFDStructure that leads to a Segmentation fault in Exiv2 0.26. A crafted input will lead to a remote denial of service attack...

DEBIAN-CVE-2017-9928

In lrzip 0.631, a stack buffer overflow was found in the function getfileinfo in lrzip.c:979, which allows attackers to cause a denial of service via a crafted file...

chromium-browser: domain spoofing in omnibox

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.104 for Mac allowed a remote attacker to perform domain spoofing via a crafted domain name...

Huawei FusionSphere and FusionSphere OpenStack Command Injection Vulnerability (CNVD-2017-09508)

Huawei FusionSphere and FusionSphere OpenStack FSO are both Huawei products. The former is a cloud operating system product developed based on the OpenStack framework, and the latter is FusionSphere's cloud platform software in ICT scenarios. A command injection vulnerability exists in Huawei...

jasper: integer overflows leading to out of bounds read in packet iterators in JPC decoder

An out-of-bounds heap read vulnerability was found in the jpcpinextpcrl function of jasper before 2.0.6 when processing crafted input...

USN-3276-1: shadow vulnerabilities

Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker could possibly cause them to crash or potentially gain privileges via crafted input. CVE-2016-6252 Tobias Stöckmann discovered a race condition in su. A local attacker could cause su to send SIGKILL to other...

Ubuntu 14.04 LTS / 16.04 LTS : shadow vulnerabilities (USN-3276-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3276-1 advisory. Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker could possibly cause them to crash or potentially gain...

Trend Micro SafeSync for Enterprise storage.pm discovery_iscsi_device Command Injection

A command injection vulnerability exists in Trend Micro's SafeSync for Enterprise storage pm page. The vulnerability is due to insufficient validation of the user-supplied parameters defining an iSCSI device to be discovered. A remote, authenticated attacker could exploit this vulnerability by...

UBUNTU-CVE-2017-7943

The ReadSVGImage function in svg.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file...

AZL-6885 CVE-2015-4646 affecting package squashfs-tools for versions less than 4.5-1

1 unsquash-1.c, 2 unsquash-2.c, 3 unsquash-3.c, and 4 unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service application crash via a crafted input...