JasPer Denial of Service Vulnerability (CNVD-2017-25686)

JasPer is an open source project that aims to provide a free software-based reference implementation of the codecs specified in the JPEG-2000 Part-1 standard. A denial of service vulnerability exists in the jpcdequantize function in jpc/jpcdec.c in JasPer, which can be exploited by a remote...

A week in security (August 21 – August 27)

In our blog posts, we announced the introduction of, and explained the necessity for, real-time protection for our Mac and Android users. Also explaining what you can expect them to do for you and answering the questions that we expect to be frequently asked. We looked at 4 key steps you can take...

Military Robots as a Nature Analog

This very interesting essay looks at the future of military robotics and finds many analogs in nature: Imagine a low-cost drone with the range of a Canada goose, a bird that can cover 1,500 miles in a single day at an average speed of 60 miles per hour. Planet Earth profiled a single flock of sno...

The vulnerability of the NFSv4 protocol in the Solaris operating system, which allows a hacker to trigger a service failure

The vulnerability of the NFSv4 protocol in the Solaris operating system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause service interruptions such as downtime or, in rare cases, forced shutdowns of the system...

Why It’s Still A Bad Idea to Post or Trash Your Airline Boarding Pass

An October 2015 piece published here about the potential dangers of tossing out or posting online your airline boarding pass remains one of the most-read stories on this site. One reason may be that the advice remains timely and relevant: A talk recently given at a Czech security conference...

The vulnerability of the ipxitf_ioctl function in the Linux kernel’s net/ipx/af_ipx.c file, which allows a attacker to cause a service failure or exert other effects

The vulnerability of the ipxitfioctl function in the Linux kernel’s net/ipx/afipx.c file is related to an incorrect counting of pointers. Exploiting this vulnerability could allow a local attacker to cause a service failure i.e., the resource becomes unavailable after being released, or other...

The vulnerability of the Oniguruma library, related to writing beyond the buffer boundaries on the stack, allows a hacker to cause a service failure.

The vulnerability of the Oniguruma library exists due to the improper handling of the code position 0xFFFFFFFF in the unicodeunfoldkey function during the compilation of regular expressions. As a result, when the nigencunicodegetcasefoldcodesbystr function is called, 4 bytes will be written at th...

Maersk Shipping Reports $300M Loss Stemming from NotPetya Attack

A.P. Moller-Maersk, the world’s largest container ship and supply vessel company, said Tuesday that it would incur hundreds of millions in U.S. dollar losses due to the NotPetya wiper malware attacks of late June. In its second quarter earnings report, Maersk executives said they were expecting...

The vulnerability of the ReadCINImage function in the console-based image editing tool ImageMagick, which allows a hacker to cause a service failure.

The vulnerability of the ReadCINImage function in the console-based image editing tool ImageMagick is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause a service failure memory consumption by using a specially crafted file...

The vulnerability of the parser_yyerror function in the UTF-8 format interpreter for Ruby allows a violator to trigger a service failure or cause other effects.

The vulnerability of the parseryyerror function in the UTF-8 format interpreter for Ruby is related to reading or writing beyond the buffer’s boundaries. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures or other effects to bypass the $SAFE...

ALPINE-CVE-2017-3636

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.5.56 and earlier and 5.6.36 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server execut...

CVE-2017-10168

Vulnerability in the Hospitality Hotel Mobile component of Oracle Hospitality Applications subcomponent: Suite 8/Windows. The supported version that is affected is 1.1. Difficult to exploit vulnerability allows physical access to compromise Hospitality Hotel Mobile. Successful attacks of this...

CVE-2017-12568

CVE-2017-12568 affects Debut embedded httpd 1.20 on Brother DCP-J132W (and likely other DCP models). The vulnerability enables a remote attacker to cause a Denial of Service by sending a large volume of HTTP packets, ultimately hanging the printer and disrupting its network connection. Descriptio...

Oracle Hospitality WebSuite8 Cloud Service Remote Vulnerability

Oracle Hospitality Applications is a suite of business applications, servers and storage solutions for hospitality management from Oracle. The solution provides human resources cost management, provide customer service throughout the journey tracking management to improve customer satisfaction,...

CVE-2017-11382

Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service. Formerly ZDI-CAN-4350...

Huawei Mate 9 DoS Vulnerability

Huawei Mate 9 is a smartphone from Chinese company Huawei Huawei. The Huawei Mate 9 is vulnerable to a DoS attack. An attacker can exploit the vulnerability to trick users into installing a malicious application, which can cause some system functions to become unavailable due to the system's...

Pharmaceutical Giant Still Feeling NotPetya's Sting

NotPetya was massive shift in malware tactics as what was initially believed to be another global ransomware attack on par with WannaCry was instead a wiper in disguise. It claimed thousands of victims worldwide, including some of the highest profile manufacturers, critical infrastructure provide...

UBUNTU-CVE-2017-11547

The resamplegauss function in resample.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted mid file. NOTE: a crash might be relevant when using the --background option. NOTE: the TiMidity++ README.alsaseq documentation suggests a...

The vulnerability of the WebKit component of the Safari browser, the iOS operating system, and the multimedia player iTunes allows a malicious actor to trigger a service failure or execute arbitrary code in a privileged context.

The vulnerability of the WebKit component in the Safari browser, the iOS operating system, and the multimedia player iTunes arises from an operation that goes beyond the buffer limits in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged conte...

Artifex Ghostscript GhostXPS heap buffer overflow vulnerability (CNVD-2017-22385)

Artifex Ghostscript is an open source PostScript a page description language and programming language for the electronics industry and desktop publishing parser from Artifex Software. A security vulnerability exists in the 'InsJMPR' function of the base/ttinterp.c file in Artifex Ghostscript...