Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3420-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3420-1 advisory. It was discovered that a buffer overflow existed in the Bluetooth stack of the Linux kernel when handling L2CAP configuration responses. A physically...

USN-3420-2 linux-lts-xenial vulnerabilities

USN-3420-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that a buffer overflow existed in the Bluetooth stack of the Linux...

USN-3420-2: Linux kernel (Xenial HWE) vulnerabilities

USN-3420-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that a buffer overflow existed in the Bluetooth stack of the Linux...

USN-3420-1: Linux kernel vulnerabilities

It was discovered that a buffer overflow existed in the Bluetooth stack of the Linux kernel when handling L2CAP configuration responses. A physically proximate attacker could use this to cause a denial of service system crash. CVE-2017-1000251 It was discovered that the Flash-Friendly File System...

USN-3420-1 linux, linux-aws, linux-gke, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

It was discovered that a buffer overflow existed in the Bluetooth stack of the Linux kernel when handling L2CAP configuration responses. A physically proximate attacker could use this to cause a denial of service system crash. CVE-2017-1000251 It was discovered that the Flash-Friendly File System...

USN-3415-1: tcpdump vulnerabilities

Wilfried Kirsch discovered a buffer overflow in the SLIP decoder in tcpdump. A remote attacker could use this to cause a denial of service application crash or possibly execute arbitrary code. CVE-2017-11543 Bhargava Shastry discovered a buffer overflow in the bitfield converter utility function...

USN-3415-1 tcpdump vulnerabilities

Wilfried Kirsch discovered a buffer overflow in the SLIP decoder in tcpdump. A remote attacker could use this to cause a denial of service application crash or possibly execute arbitrary code. CVE-2017-11543 Bhargava Shastry discovered a buffer overflow in the bitfield converter utility function...

CVE-2017-14272

XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode Write AV starting at jbig2dec+0x000000000000595d."...

ALPINE-CVE-2017-14223

In libavformat/asfdecf.c in FFmpeg 3.3.3, a DoS in asfbuildsimpleindex due to lack of an EOF End of File check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would...

UBUNTU-CVE-2017-14223

In libavformat/asfdecf.c in FFmpeg 3.3.3, a DoS in asfbuildsimpleindex due to lack of an EOF End of File check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would...

Memory Override Access Vulnerability in Xunlei Look Client

Xunlei Look client is Xunlei's video playback software. A memory override access vulnerability exists in the Xunlei Look client's decoder when decoding special mp4 files. An attacker could exploit this vulnerability to cause a denial of service...

Debian DSA-3957-1 : ffmpeg - security update

Several vulnerabilities have been discovered in FFmpeg, a multimedia player, server and encoder. These issues could lead to Denial-of-Service and, in some situation, the execution of arbitrary code. - CVE-2017-9608 Yihan Lian of Qihoo 360 GearTeam discovered a NULL pointer access when parsing a...

Denial of Service Vulnerability in Storm Video 5

Storm Video 5 is the video playback software of Beijing Storm Technology Co. Storm Video 5 decoder has a denial of service vulnerability when decoding special mp4 files, which can be exploited by attackers to cause the software to crash, resulting in a denial of service...

Memory Override Vulnerability in Sohu Video 5

Sohu Video 5 is Sohu's video playback software for PC. A memory override vulnerability exists in Sohu Video 5's decoder when decoding special mp4 files. An attacker exploited the vulnerability to cause the software to crash, resulting in a denial of service...

librawspeed: Index-out-of-bounds in std::__1::array<rawspeed::HuffmanTable*, 2> rawspeed::AbstractLJpegDecompressor:

Detailed report: https://oss-fuzz.com/testcase?key=6130578116050944 Project: librawspeed Fuzzer: libFuzzerlibrawspeedFiffParserFuzzer-GetDecoder-Decode Fuzz target binary: FiffParserFuzzer-GetDecoder-Decode Job Type: libfuzzerubsanlibrawspeeduntrusted Platform Id: linux Crash Type:...

Vulnerability in the MPEG-2 decoder of the Android operating system, allowing a hacker to execute arbitrary code

The vulnerability in the MPEG-2 decoder of the Android operating system is related to deficiencies in access control. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Vulnerability in the MPEG-2 decoder of the Android operating system, allowing a hacker to execute arbitrary code

The vulnerability in the MPEG-2 decoder of the Android operating system is related to deficiencies in access control. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Vulnerability in the Android operating system’s media framework (H263 decoder), allowing a perpetrator to execute arbitrary code

The vulnerability in the Android operating system’s media framework H263 decoder is related to lack of access control. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Vulnerability in the multimedia framework (AVC decoder) of the Android operating system, allowing a hacker to execute arbitrary code

The vulnerability in the multimedia framework AVC decoder of the Android operating system is related to deficiencies in access control. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

DEBIAN-CVE-2017-12863

In opencv/modules/imgcodecs/src/grfmtpxm.cpp, function PxMDecoder::readData has an integer overflow when calculate srcpitch. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier...