The vulnerability of Adobe After Effects’ video and dynamic image editing software lies in the ability to write code beyond the buffer boundaries in memory, allowing attackers to execute arbitrary code.

The vulnerability of Adobe After Effects’ video and dynamic image editing software lies in the writing of code beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...

Mozilla Rust Resource Management Error Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in http crate in versions of Mozilla Rust prior to 0.1.20, which stems from HeaderMap:: The Drain API can use raw pointers to corrupt sound effects. No details of the vulnerabilit...

Pulse Secure VPN Remote Code Execution Exploit

The Pulse Connect Secure appliance versions prior to 9.1R9 suffer from an uncontrolled gzip extraction vulnerability which allows an attacker to overwrite arbitrary files, resulting in remote code execution as root. Admin credentials are required for successful exploitation...

Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow Exploit

This Metasploit module exploits a stack-based buffer overflow in the Solaris PAM library's username parsing code, as used by the SunSSH daemon when the keyboard-interactive authentication method is specified. Tested against SunSSH 1.1.5 on Solaris 10u11 1/13 x86 in VirtualBox, VMware Fusion, and...

Debian DLA-2491-1 : openexr security update

Two issues were discovered in openexr, a set of tools to manipulate OpenEXR image files, often in the computer-graphics industry for visual effects and animation. For Debian 9 'Stretch', these problems has been fixed in version 2.2.0-11+deb9u2. We recommend that you upgrade your openexr packages...

[SECURITY] [DLA 2491-1] openexr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2491-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb December 13, 2020 https://wiki.debian.org/LTS -...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:3311-1)

This update for MozillaFirefox fixes the following issues : Firefox Extended Support Release 78.4.1 ESR - Fixed: Security fix MFSA 2020-49 bsc1178588 - CVE-2020-26950 bmo1675905 Write side effects in MCallGetProperty opcode not accounted for Note that Tenable Network Security has extracted the...

Apache NiFi API Remote Code Execution Exploit

This Metasploit module uses the NiFi API to create an ExecuteProcess processor that will execute OS commands. The API must be unsecured or credentials provided and the ExecuteProcess processor must be available. An ExecuteProcessor processor is created then is configured with the payload and...

Scientific Linux Security Update : thunderbird on SL6.x i686/x86_64 (2020:5164)

The remote Scientific Linux 6 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2020:5164-1 advisory. - Mozilla: Write side effects in MCallGetProperty opcode not accounted for CVE-2020-26950 Note that Nessus has not tested for this issue but has instead...

Mozilla: Write side effects in MCallGetProperty opcode not accounted for

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox 82.0.3, Firefox ESR 78.4.1, and Thunderbird 78.4.2...

RHEL 8 : thunderbird (RHSA-2020:5162)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5162 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.4.3. Security Fixes: Mozilla: Write sid...

Adobe After Effects has a dll hijacking vulnerability (CNVD-2020-69406)

Adobe is an American multinational computer software company headquartered in San Jose, California. It is mainly engaged in the development of multimedia production software. A dll hijacking vulnerability exists in Adobe After Effects. An attacker can exploit this vulnerability to load a maliciou...

Oracle WebLogic Server Administration Console Handle Remote Code Execution Exploit

This Metasploit module exploits a path traversal and a Java class instantiation in the handle implementation of WebLogic's Administration Console to execute code as the WebLogic user. Versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 are known to be affected. Tested against...

Mozilla: Write side effects in MCallGetProperty opcode not accounted for

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox 82.0.3, Firefox ESR 78.4.1, and Thunderbird 78.4.2...

openSUSE Security Update : MozillaFirefox (openSUSE-2020-1919)

This update for MozillaFirefox fixes the following issues : - Firefox Extended Support Release 78.4.1 ESR - Fixed: Security fix MFSA 2020-49 bsc1178588 - CVE-2020-26950 bmo1675905 Write side effects in MCallGetProperty opcode not accounted for This update was imported from the SUSE:SLE-15:Update...

The vulnerability of Adobe After Effects’ video and dynamic image editing software lies in its ability to read data beyond the buffer limit in memory, allowing an attacker to execute arbitrary code within the context of the current user.

The vulnerability of Adobe After Effects’ video and dynamic image editing software relates to reading beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...

The vulnerability of Adobe After Effects’ video and dynamic image editing software lies in its uncontrolled search path, allowing attackers to execute arbitrary code within the context of the current user.

The vulnerability of Adobe After Effects video and dynamic image editing software is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, using a specially crafted file...

Oracle Linux 6 : firefox (ELSA-2020-5104)

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5104 advisory. 78.4.1-1.0.1 - fix LDLIBRARYPATH - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one Tue Nov 10 2020 [email protected] - 78.4.1-1 -...

Security fix for the ALT Linux 10 package thunderbird version 78.4.2-alt1

Nov. 11, 2020 Andrey Cherepanov 78.4.2-alt1 - New version 78.4.2. - Fixes: + CVE-2020-26950 Write side effects in MCallGetProperty opcode not accounted for...

Mozilla Thunderbird Security Advisory (MFSA2020-49) - Windows

Mozilla Thunderbird is prone to a code execution vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...