Fedora 25 : poppler (2017-690eedcf41)

CVE-2017-7511 poppler: NULL pointer dereference in pdfunite via crafted documents Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

CVE-2017-7511

poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents...

Null pointer dereference

poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents...

DEBIAN-CVE-2017-7511

poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents...

CVE-2017-7511

poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents...

CVE-2017-7511

poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents...

CVE-2017-7511

poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents...

CVE-2017-7511

poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents...

PT-2017-17781 · Poppler +2 · Poppler +2

Name of the Vulnerable Software and Affected Versions: poppler versions 0.17.3 and later Description: The issue is related to a NULL pointer dereference in the pdfunite component of poppler, triggered by specially crafted documents. Recommendations: For poppler versions 0.17.3 and later, at the...

CVE-2017-7511

poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents...

Tainted Leaks

Last year, I wrote about the potential for doxers to alter documents before they leaked them. It was a theoretical threat when I wrote it, but now Citizen Lab has documented this technique in the wild: This report describes an extensive Russia-linked phishing and disinformation campaign. It...

CVE-2014-0225

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack...

CVE-2014-0225

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack...

Metadata Anonymisation Toolkit Information Disclosure Vulnerability

Metadata Anonymisation Toolkit MAT is a metadata anonymization toolkit. The toolkit supports the anonymization or deletion of metadata such as Word documents, images and music files. An information disclosure vulnerability exists in MAT versions 0.6 and 0.6.1. An attacker can exploit this...

LVRTC eParakstitajs 3 and edoc-libraries arbitrary file write vulnerability

LVRTC eParakstitajs 3 and edoc-libraries are both products of the Latvian company LVRTC. The former is an electronic signature solution for insurance use; the latter is a file system for specially created and produced EDOC documents. An arbitrary file write vulnerability exists in LVRTC...

DocuSign Phishing Campaign Includes Hancitor Downloader

Electronic document exchange vendor DocuSign warned on Monday of a wave of phishing emails targeting its customers with links to malicious Word documents. The campaign, it said, was tied to an earlier breach of its computer networks where hackers were able to gain “temporary access” and exfiltrat...

[SECURITY] Fedora 26 Update: jbig2dec-0.13-3.fc26

jbig2dec is a decoder implementation of the JBIG2 image compression format. JBIG2 is designed for lossy or lossless encoding of 'bilevel' 1-bit monochrome images at moderately high resolution, and in particular scanned paper documents. In this domain it is very efficient, offering compression...

EPS Processing Zero-Days Exploited by Multiple Threat Actors

In 2015, FireEye published details about two attacks exploiting vulnerabilities in Encapsulated PostScript EPS of Microsoft Office. One was a zero-day and one was patched weeks before the attack launched. Recently, FireEye identified three new zero-day vulnerabilities in Microsoft Office products...

OpenJDK: incomplete XML parse tree size enforcement (JAXP, 8169011)

It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory...

Stealthy Konni RAT Targeting North Korea Since 2014

Two recent espionage campaigns against political and strategic targets in North Korea has been linked to malware that has stayed hidden for the better part of three years. Cisco’s research arm Talos published a report yesterday on the malware it calls Konni. Two attacks in April used phishing...