Verizon Partners With U.S. Secret Service on Data Breach Report

Verizon’s invaluable Data Breach Investigations Report will now include data from hundreds of computer crime cases investigated by the U.S. Secret Service, the company announced this week. The report, which is among the best at tracking data loss incidents, is based on a framework called VERIS .p...

Microsoft Excel Malformed Range Code Execution (MS06-012; CVE-2005-4131)

Microsoft Excel is a spreadsheet application released by the Microsoft Corporation. Its native file format is the Binary Interchange File Format BIFF, which is available is several versions. An Excel file contains information about the various spreadsheets that form an Excel workbook, the data an...

Microsoft Color Management Memory Allocation Buffer Overflow (MS08-046; CVE-2008-2245)

A buffer overflow vulnerability exists in Microsoft Color Management System. The vulnerability is due to a boundary error in the Microsoft Color Management System MSCMS module of the Microsoft Image Color Management ICM component. Remote unauthenticated attackers could exploit this vulnerability ...

Microsoft Windows WMF Handling Arbitrary Code Execution (CVE-2005-4560)

There exists a code execution vulnerability in Microsoft Windows. The vulnerability is created by unrestricted access to GDI functions through WMF files. An attacker can exploit this vulnerability to supply and execute arbitrary code through calling a specific GDI function via a crafted WMF file...

GLSA-201001-09 : Ruby: Terminal Control Character Injection

The remote host is affected by the vulnerability described in GLSA-201001-09 Ruby: Terminal Control Character Injection Giovanni Pellerano, Alessandro Tanasi and Francesco Ongaro reported that WEBrick does not filter terminal control characters, for instance when handling HTTP logs. Impact : A...

Microsoft Excel Malformed OBJECT Record Code Execution (MS06-037; CVE-2006-1306)

There exists an arbitrary index pointer code execution vulnerability in Microsoft Excel. The flaw is caused by an insufficient check of a malformed OBJECT Record in an Excel file. An attacker can exploit this vulnerability to inject and execute arbitrary code in the security context of the...

Microsoft Works File Converter WPS File Section Header Index Table Stack Overflow (MS08-011; CVE-2008-0105)

Microsoft Works is a home/office productivity software suite. Its core functionality includes a word processor, a spreadsheet, and a database. A Microsoft Works Document, normally denoted by the extension .wps, has numerous properties which define the appearance of the document, as well as some...

Microsoft Excel File Named Graph Record Parsing Stack Overflow (MS07-023; CVE-2007-0215)

Microsoft Excel is a popular spreadsheet application that is usually released as part of the Microsoft Office suite. The application can create complex spreadsheets with multiple workbooks, formulae, and various data sources. The proprietary file format used for storing Microsoft Excel documents ...

Microsoft Excel Set Font Handling Code Execution (MS07-023; CVE-2007-1203)

Microsoft Excel is a popular spreadsheet application that is usually released as part of the Microsoft Office suite. The application can create complex spreadsheets with multiple workbooks, formulae, and various data sources. The proprietary file format used for storing Microsoft Excel documents ...

Microsoft Excel rtWindow1 Record Handling Code Execution (CVE-2007-3029)

Microsoft Excel is a popular spreadsheet application that is usually released as part of the Microsoft Office suite. The application can create complex spreadsheets with multiple workbooks, formula, and various data sources. The common extension used for Microsoft Excel documents is .xls or .xlw....

Microsoft Word Document Stream Handling Code Execution (MS07-024; CVE-2007-0870)

Microsoft Word is a document authoring product released by the Microsoft Corporation. Microsoft Word is available packaged with the Microsoft Office suite, as well as in form of a standalone product. Its native file format is the Word Document, normally identified by the .doc file extension. A Wo...

Virginia Loses Records for 103,000 Adult Education Students

The parade of large-scale data losses is continuing unabated. The latest incident involves an unencrypted Flash drive containing the personal information of more than 100,000 adult education students in Virginia. The drive was lost late last month and no one seems to have found it yet. According ...

Buffer overflow

Buffer overflow in xlssr.dll in the Autonomy KeyView XLS viewer aka File Viewer for Excel, as used in IBM Lotus Notes 5.x through 8.5.x, Symantec Mail Security, Symantec BrightMail Appliance, Symantec Data Loss Prevention DLP, and other products, allows remote attackers to execute arbitrary code...

CVE-2009-3037

CVE-2009-3037 is a buffer overflow in the Autonomy KeyView XLS viewer (xlssr.dll) used by IBM Lotus Notes and multiple Symantec products (Mail Security, BrightMail, DLP, etc.). The overflow occurs while parsing Excel .xls attachments, enabling remote code execution by enticing a user to open a ma...

Update Protection against Adobe RoboHelp Server SQL Injection Vulnerability

Adobe RoboHelp Server is vulnerable to a SQL injection attack. A remote attacker can trigger this vulnerability by sending a specially crafted URL to a vulnerable installation of RoboHelp Server. An attacker would need to have access to the RoboHelp Help Errors log, or convince someone with acces...

Apple Safari & Quicktime Denial of Service Vulnerability

No description provided by source. Apple Safari & Quicktime Denial of Service Shameless plug : ------------------------------------------------------------------------ You are invited to join the 2009 edition of HACK.LU, a small but concentrated luxemburgish security conference. More information ...

[TZO-36-2009] Apple Safari & Quicktime Denial of Service

Apple Safari & Quicktime Denial of Service Shameless plug : ------------------------------------------------------------------------ You are invited to join the 2009 edition of HACK.LU, a small but concentrated luxemburgish security conference. More information : http://www.hack.lu - CFP is open,...

Apple Safari / QuickTime - Denial of Service

Apple Safari & Quicktime Denial of Service Shameless plug : ------------------------------------------------------------------------ You are invited to join the 2009 edition of HACK.LU, a small but concentrated luxemburgish security conference. More information : http://www.hack.lu - CFP is open,...

Sun Solaris Secure Digital Slot Driver (sdhost(7D))本地代码执行漏洞

Bugraq ID: 35069 CNCAN ID：CNCAN-2009052504 Sun Solaris是一款商业性质的操作系统。 Sun Solaris Secure Digital slot driver sdhost7D存在安全漏洞，能访问内存卡设备的本地用户可破坏内核内存或内存卡内容导致数据丢失，或可能允许以内核上下文执行任意代码。 目前没有详细漏洞细节提供。 Sun OpenSolaris build snv108 Sun OpenSolaris build snv107 Sun OpenSolaris build snv106 Sun OpenSolaris build...

MDVA-2008:012 : lzma

The lzma program did not properly check that the closing of output succeeded, which could lead to rare, but possible, data loss. Another issue with liblzmadec was also discovered where programs could crash if decoding of a stream was not properly initialized. This update ensures that output is...