The vulnerability of the XSLT implementation for converting XML documents in Firefox browsers allows attackers to trigger a service failure or execute arbitrary code.

The vulnerability of the XSLT transformation language for XML documents in Firefox browsers arises due to incorrect checking of number formatting boundaries during formatting operations. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

Debian DLA-1947-1 : libreoffice security update

Several vulnerabilities were discovered in LibreOffice, the office productivity suite. CVE-2019-9848 Nils Emmerich discovered that malicious documents could execute arbitrary Python code via LibreLogo. CVE-2019-9849 Matei Badanoiu discovered that the stealth mode did not apply to bullet graphics...

Service workers at TPAC

Last month we had a service worker meeting at the W3C TPAC conference in Fukuoka. For the first time in a few years, we focused on potential new features and behaviours. Here's a summary: Resurrection finally killed reg.unregister; If you unregister a service worker registration, it's removed fro...

Service workers at TPAC

Last month we had a service worker meeting at the W3C TPAC conference in Fukuoka. For the first time in a few years, we focused on potential new features and behaviours. Here's a summary: Resurrection finally killed reg.unregister; If you unregister a service worker registration, it's removed fro...

The vulnerability of the DirectWrite programming interface in Windows operating systems allows attackers to gain unauthorized access to protected information.

The vulnerability of the DirectWrite programming interface in Windows operating systems is related to errors in object handling in memory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information by opening a specially...

The vulnerability of the DirectWrite programming interface in Windows operating systems allows attackers to gain unauthorized access to protected information.

The vulnerability of the DirectWrite programming interface in Windows operating systems is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by opening a specially created document or visiting a...

CVE-2019-9853

LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in...

USN-4138-1 libreoffice vulnerability

It was discovered that LibreOffice incorrectly handled embedded scripts in document files. If a user were tricked into opening a specially crafted document, a remote attacker could possibly execute arbitrary code...

SUSE-SU-2019:2440-1 Security update for expat

This update for expat fixes the following issues: Security issue fixed: - CVE-2019-15903: Fixed a heap-based buffer over-read caused by crafted XML documents. bsc1149429...

The vulnerability of the Windows operating system’s font library allows a hacker to execute arbitrary code and gain control over the vulnerable system.

The vulnerability of the Windows operating system’s font library relates to errors in processing specially created embedded fonts. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely and gain control over the vulnerable system through a specially created web...

Malware Moves: The Rise of LookBack – And Return of Emotet

Malware activity for various families continues to ebb and flow; with a popular malware called LookBack recently discovered in a slew of campaigns, and Emotet and other malware variants that were quiet over the summer set to make a dangerous comeback. Researchers believe that nation-state actors...

[SECURITY] Fedora 30 Update: jbig2dec-0.16-1.fc30

jbig2dec is a decoder implementation of the JBIG2 image compression format. JBIG2 is designed for lossy or lossless encoding of 'bilevel' 1-bit monochrome images at moderately high resolution, and in particular scanned paper documents. In this domain it is very efficient, offering compression...

North Korean Spear-Phishing Attack Targets U.S. Firms

Researchers have uncovered an ongoing, sophisticated malware campaign aiming at U.S.-based targets with an interest in nuclear deterrence, North Korea’s nuclear submarine program and North Korean economic sanctions. The campaign, which researchers from Prevailion call “Autumn Aperture” and link...

poppler: heap-based buffer over-read in XRef::getEntry in XRef.cc

In Poppler 0.73.0, a heap-based buffer over-read due to an integer signedness error in the XRef::getEntry function in XRef.cc allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo...

poppler: stack consumption in function Dict::find() in Dict.cc

PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find located at Dict.cc, which can for example be triggered by passing a crafted pdf file to the pdfunite binary...

Microsoft Excel Information Disclosure Vulnerability (CNVD-2019-31855)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. An information disclosure vulnerability exists in Microsoft Excel, which can be exploited by an attacker to compromise a user's computer or data with the help of specially crafted document files...

[SECURITY] Fedora 29 Update: pdfbox-2.0.16-1.fc29

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is...

UBUNTU-CVE-2019-16115

In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause...

PT-2019-14519 · Foolabs +1 · Xpdf +1

Name of the Vulnerable Software and Affected Versions: Xpdf version 4.01.01 Description: A stack-based buffer under-read issue exists in the IdentityFunction::transform function in Function.cc, which is used by GfxAxialShading::getColor. This issue can be triggered by sending a crafted PDF docume...

Fedora Update for pdfresurrect FEDORA-2019-e01bc28777

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...