MGASA-2018-0105 Updated sox packages fix security vulnerability

There is a heap-based buffer overflow in the ImaExpandS function of imarw.c in Sound eXchange SoX 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file CVE-2017-15370. There is a reachable assertion abort in the function soxappendcomment in formats.c i...

Automattic: Disclosure of 152 cookie names via crafted input

If someone sends a cookie called '0', automattic.com responds with a list of all 152 cookies supported by the application: curl -v -H 'Cookie: 0=1' https://automattic.com/?cb=123 | fgrep Cookie Set-Cookie: ██████=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/;...

ClamAV Buffer Overflow Vulnerability (CNVD-2018-03238)

ClamAV AntiVirus software is a free and open source antivirus software developed by ClamAV team. The software is used to detect Trojans, viruses, malware and other malicious threats. A buffer overflow vulnerability exists in ClamAV AntiVirus software that stems from a message parsing function tha...

CVE-2017-16557

K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way...

Updated xrdp packages fix security vulnerability

The scpv0saccept function in sesman/libscp/libscpv0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted input...

Memory leak vulnerability in multiple Huawei products (CNVD-2017-37503)

Huawei AR and SRG series enterprise routers are all-in-one routers for small and medium-sized offices or branches of small and medium-sized enterprises launched by Huawei; TE series, DP300, and MAX PRESENCE are all integrated desktop smart products and high-definition videoconferencing terminals...

PT-2017-14837 · Pasdoc · Pasdoc

Name of the Vulnerable Software and Affected Versions: PasDoc version 0.14 Description: The issue concerns the delphi gui/WWWBrowserRunnerDM.pas file in PasDoc 0.14, which does not validate strings before launching the program specified by the BROWSER environment variable. This might allow remote...

CVE-2017-16375

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This issue is due to an untrusted pointer dereference in the JavaSscript API engine. In this...

CVE-2017-16395

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer access with an incorrect length value in the image conversi...

CVE-2017-16927

The scpv0saccept function in sesman/libscp/libscpv0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted input...

Design/Logic Flaw

The scpv0saccept function in sesman/libscp/libscpv0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted input...

UBUNTU-CVE-2017-16927

The scpv0saccept function in sesman/libscp/libscpv0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted input...

CVE-2017-16927

The scpv0saccept function in sesman/libscp/libscpv0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted input...

GHSA-PJJ4-W39G-PW54 Ox gem crashes due to a crafted input

In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parseobj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication...

Ox gem crashes due to a crafted input

In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parseobj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication...

PT-2018-5762 · Netapp +7 · Netapp Oncommand Shift +26

Name of the Vulnerable Software and Affected Versions: jackson-databind versions prior to 2.8.11 and 2.9.4 debian linux affected versions not specified fasterxml jackson-databind affected versions not specified netapp oncommand balance affected versions not specified netapp oncommand performance...

USN-3276-3: shadow vulnerability

USN-3276-1 and USN-3276-2 fixed vulnerabilities in shadow. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker could possibly cause them to crash or potentially gain...

The vulnerability of the FortiOS operating system arises from insufficient input data validation, allowing attackers to trigger a service failure.

The vulnerability of the FortiOS operating system exists due to the lack of input validation. Exploiting this vulnerability allows a malicious actor to cause a failure in the FortiOS web interface by entering a specially crafted string into the “params” field for URL addresses: /json...

openSUSE Security Update : libsass (openSUSE-2017-1250)

This update for libsass fixes the following DoS vulnerabilities : - CVE-2017-11554: Stack consumption vulnerability allowed remote DoS via crafted input 1050148 - CVE-2017-11555: Illegal address access in Eval::operator allowed remote DoS via crafted input boo1050149 - CVE-2017-11556: Stack...

Ruby Ox gem denial of service vulnerability

Ruby Ox gem is a Ruby-based XML parser . A denial of service vulnerability exists in Ruby Ox gem version 2.8.0. An attacker can exploit this vulnerability to cause a denial of service process crash and segmentation error with specially crafted input...