CVE-2017-11150

Command injection vulnerability in Document.php in Synology Office 2.2.0-1502 and 2.2.1-1506 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the crafted file name of RTF documents...

When combining exploits for added effect goes wrong

IntroductionSince public disclosure in April 2017, CVE-2017-0199 has been frequently used within malicious Office documents. The vulnerability allows attackers to include Ole2Link objects within RTF documents to launch remote code when HTA applications are opened and parsed by Microsoft Word.In...

[SECURITY] Fedora 26 Update: libgxps-0.3.0-1.fc26

libgxps is a GObject based library for handling and rendering XPS documents...

Adobe Acrobat/Reader Heap Buffer Overflow Vulnerability (CNVD-2017-26614)

Adobe Acrobat and Reader are the United States of America Audobee Adobe company's products. The former is a set of PDF file editing and conversion tools, the latter is a set of PDF document reading software. Adobe Acrobat and Reader in the internal data structure there is a heap buffer overflow...

Adobe Acrobat/Reader Memory Corruption Vulnerability (CNVD-2017-25780)

Adobe Reader/Acrobat is a popular application for working with PDF files. A memory corruption vulnerability exists in Adobe Reader/Acrobat. Allowing an attacker to construct a malicious PDF file and trick the user into parsing it could crash the application or execute arbitrary code...

Microsoft Internet Explorer SVG Layout Uninitialized Memory Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

libreoffice security and bug fix update

1:5.0.6.2-14.0.1 - Replaced RedHat colors with Oracle colors, and the filename redhat.soc with oracle.soc in specfile - Build with --with-vendor='Oracle America, Inc.' 1:5.0.6.2-14 - Resolves: rhbz1454693 segv on interrupting tiled rendering 1:5.0.6.2-13 - Related: rhbz1444437 remove timer if...

RHEL 7 : ghostscript (RHSA-2017:2180)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2180 advisory. The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats ...

chromium-browser: out-of-bounds write in pdfium

Stack overflow in PDFium in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit stack corruption via a crafted PDF file...

Threat Outbreak Alert RuleID30010: Email Messages Distributing Malicious Software on July 28, 2017

Medium Alert ID: 54619 First Published: 2017 July 28 14:20 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30010 may contain the following files: Name | Siz...

CVE-2017-11694

MEDHOST Document Management System contains hard-coded credentials that are used for Apache Solr access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with Apache Solr may be able to obtain or modify sensitive patient and financial information. T...

Hardcoded credentials

MEDHOST Document Management System contains hard-coded credentials that are used for Apache Solr access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with Apache Solr may be able to obtain or modify sensitive patient and financial information. T...

Microsoft Office Outlook Arbitrary Code Execution Vulnerability

Microsoft Outlook is an e-mail client software bundled with the Office suite from Microsoft USA. The software manages e-mail, contacts, calendars, and more. An arbitrary code execution vulnerability exists in Microsoft Outlook. A remote attacker can exploit this vulnerability to execute arbitrary...

Microsoft Office Outlook Arbitrary Code Execution Vulnerability (CNVD-2017-18936)

Microsoft Outlook is an e-mail client software bundled with the Office suite from Microsoft USA. The software manages e-mail, contacts, calendars, and more. An arbitrary code execution vulnerability exists in Microsoft Outlook. A remote attacker can exploit this vulnerability to execute arbitrary...

3 New CIA-developed Hacking Tools For MacOS & Linux Exposed

WikiLeaks has just published a new set of classified documents linked to another CIA project, dubbed 'Imperial,' which reveals details of at least three CIA-developed hacking tools and implants designed to target computers running Apple Mac OS X and different flavours of Linux operating systems. ...

DEBIAN-CVE-2017-9740

The xpsdecodefontcharimp function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash or possibly have unspecified other impact via a crafted document...

[SECURITY] Fedora 25 Update: libmwaw-0.3.12-1.fc25

libmwaw is a library for import of old Mac documents. It supports many kinds of text documents, spreadsheets, databases, vector and bitmap images. Supported are, for example, documents created by BeagleWorks, ClarisWorks, MacPaint, MacWrite or Microsoft Word for Mac. A full list of supported...

Nitro Pro PDF - Multiple Vulnerabilities

Nitro Pro PDF - Multiple Vulnerabilities Vulnerabilities Summary The following advisory describes three vulnerabilities found in Nitro / Nitro Pro PDF. Nitro Pro is the PDF reader and editor that does everything you will ever need to do with PDF files. The powerful but snappy editor lets you chan...

OpenJDK: insecure XML parsing in wsdlimport (JAX-WS, 8182054)

It was discovered that the wsdlimport tool in the JAX-WS component of OpenJDK did not use secure XML parser settings when parsing WSDL XML documents. A specially crafted WSDL document could cause wsdlimport to use an excessive amount of CPU and memory, open connections to other hosts, or leak...

UBUNTU-CVE-2017-9765

Integer overflow in the soapget function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow and application crash via a large XML document, aka Devil'...