Threat Round Up for Oct 6 - Oct 13

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between October 6 and October 13. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior...

IrfanView buffer overflow vulnerability (CNVD-2017-30370)

IrfanView is a Bosnia and Herzegovina software developer Irfan Skiljan developed a picture viewer, which supports image browsing, image editing, image format conversion, etc. PDF plugin is one of the PDF document reading plug-ins. IrfanView 4.44 32-bit in the PDF plugin version 4.43 there is a...

Threat Outbreak Alert RuleID30825: Email Messages Distributing Malicious Software on October 2, 2017

Medium Alert ID: 55493 First Published: 2017 October 2 12:53 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30825 may contain the following files: Name |...

[SECURITY] Fedora 27 Update: libbson-1.8.0-1.fc27

This is a library providing useful routines related to building, parsing, and iterating BSON documents...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document. Remediation There is no fixed version for poppler. References -...

UBUNTU-CVE-2016-4434

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity XXE attacks via vectors involving 1 spreadsheets in OOXML files and 2 XMP metadata in PDF and other file formats, a related issue to...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. In Poppler 0.59.0, a NULL Pointer Dereference exists in the SplashOutputDev::type3D0 function in SplashOutputDev.cc via a crafted PDF document. Remediation There is no fixed version for poppler. References -...

Extreme Office 2017 suffers from a memory corruption vulnerability (CNVD-2017-31178)

Extreme Office is an independently controlled office learning software developed by Beijing Haiteng Times Technology Co. Extreme Writing 2017 can create, modify and edit doc, docx files. Extreme Writing in Extreme Office suffers from a memory corruption vulnerability when handling special docx...

Extreme Office 2017 suffers from a memory corruption vulnerability (CNVD-2017-31167)

Extreme Office is an independently controlled office learning software developed by Beijing Haiteng Times Technology Co. Extreme Writing 2017 can create, modify and edit doc, docx files. Extreme Writing in Extreme Office suffers from a memory corruption vulnerability when handling special docx...

SEC Discloses Hackers Broke Into Edgar Corporate Filing System Last Year

This month has been full of breaches. Now, the Securities and Exchange Commission SEC, the top U.S. markets regulator, has disclosed that hackers managed to hack into its financial document filing system and may have illegally profited from the stolen information. On Wednesday, the SEC announced...

DEBIAN-CVE-2017-14617

In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files...

Extreme PDF Reader suffers from heap corruption vulnerability

Extreme PDF Reader is a domestic free PDF reader developed by Beijing Haiteng Times Technology Co. Extreme PDF Reader has a heap corruption vulnerability when parsing special PDF files. An attacker can exploit the vulnerability to cause a denial of service...

[SECURITY] Fedora 26 Update: libwpd-0.10.2-1.fc26

libwpd is a library for import of WordPerfect documents...

Protecting Confidential Data: You May Not Be as Secure as You Think

Part One of a Three Part Series Unless you have been out of the country or otherwise shunning the news, you have likely heard that on September 7th and again on September 15th, Equifax reported that it suffered a security incident from May 13th through July 30th, 2017. This breach is broad reachi...

Microsoft Edge 38.14393.1066.0 - Memory Corruption with Partial Page Loading

Microsoft Edge 38.14393.1066.0 - Memory Corruption with Partial Page Loading Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1309 There is a security issue in Microsoft Edge related to how HTML documents are loaded. If Edge displays a HTML document from a slow HTTP server, it is...

Microsoft Edge 38.14393.1066.0 - Memory Corruption with Partial Page Loading

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1309 There is a security issue in Microsoft Edge related to how HTML documents are loaded. If Edge displays a HTML document from a slow HTTP server, it is possible that a part of the document is going to be rendered before the serv...

Threat Outbreak Alert RuleID30637: Email Messages Distributing Malicious Software on September 18, 2017

Medium Alert ID: 55318 First Published: 2017 September 18 14:18 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30637 may contain the following files: Name ...

Cross-site Scripting (XSS) Through SVG Documents

silverstripe/installer and silverstripe/framework are vulnerable to cross-site scripting XSS attacks. These attacks are possible because the Insert Media option within the content editor, and the pathname in admin/assests/add allow attackers to insert SVG documents containing arbitrary javascript...

SugarCRM Documents and Emails Module SQL Injection Vulnerability

SugarCRM is the United States SugarCRM company's set of open source customer relationship management system CRM. Documents and Emails module is one of the modules. documents is a document management module. emails is an e-mail module. A SQL injection vulnerability exists in the Documents and Emai...

SilverStripe CMS Cross-Site Scripting Vulnerability (CNVD-2017-34509)

SilverStripe CMS is a New Zealand SilverStripe company's open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . A cross-site scripting vulnerability exists in SilverStripe CMS versions prior to 3.6.1...