5369 matches found
Microsoft Internet Explorer 9 - MSHTML CDispNode::InsertSiblingNode Use-After-Free (MS13-037) (2)
!-- Source: http://blog.skylined.nl/20161208001.html Synopsis A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability. Known...
Updated thunderbird packages fix security vulnerabilities
A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash CVE-2016-5296. The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This...
SUSE SLES11 Security Update : kernel (SUSE-SU-2016:2976-1)
The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. For the PowerPC64 a new 'bigmem' flavor has been added to support big Power machines. FATE319026 The following security bugs were fixed : - CVE-2016-7042: The prockeysshow function in security/keys/proc....
Debian DSA-3728-1 : firefox-esr - security update
A use-after-free vulnerability in the SVG Animation was discovered in the Mozilla Firefox web browser, allowing a remote attacker to cause a denial of service application crash or execute arbitrary code, if a user is tricked into opening a specially crafted website. %NASLMINLEVEL 70300 C Tenable...
DSA-3728-1 firefox-esr - security update
Bulletin has no description...
KLA10906 Use-after-free vulnerability in Mozilla products
A use-after-free vulnerability was found in Mozilla Firefox before 50.0.2, Mozilla Firefox ESR before 45.5.1 and Mozilla Thunderbird before 45.5.1. Exploiting this vulnerability can possibly lead to a denial of service and also an execution of arbitrary code. This vulnerability can be exploited...
CVE-2015-8962
Double free vulnerability in the sgcommonwrite function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service memory corruption and system crash by detaching a device during an SGIO ioctl call...
CVE-2015-8962
CVE-2015-8962: Double free in sg_common_write (drivers/scsi/sg.c) of the Linux kernel before 4.4. A local user can gain privileges or cause memory corruption/system crash by detaching a device during an SG_IO ioctl. Remediation: upgrade to Linux kernel 4.4+ or apply vendor patch; exploitation con...
CVE-2015-8962
Double free vulnerability in the sgcommonwrite function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service memory corruption and system crash by detaching a device during an SGIO ioctl call...
CVE-2016-7910
Use-after-free vulnerability in the diskseqfstop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed...
SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2016:2775-1)
This update for jasper to version 1.900.14 fixes several issues. These security issues were fixed : - CVE-2016-8887: NULL pointer dereference in jp2colrdestroy jp2cod.c bsc1006836 - CVE-2016-8886: memory allocation failure in jasmalloc jasmalloc.c bsc1006599 - CVE-2016-8884,CVE-2016-8885: two NUL...
SUSE SLES11 Security Update : jasper (SUSE-SU-2016:2776-1)
This update for jasper fixes the following issues: Security fixes : - CVE-2016-8887: NULL pointer dereference in jp2colrdestroy jp2cod.c bsc1006836 - CVE-2016-8886: memory allocation failure in jasmalloc jasmalloc.c bsc1006599 - CVE-2016-8884,CVE-2016-8885: two NULL pointer dereferences in...
SUSE-SU-2016:2776-1 Security update for jasper
This update for jasper fixes the following issues: Security fixes: - CVE-2016-8887: NULL pointer dereference in jp2colrdestroy jp2cod.c bsc1006836 - CVE-2016-8886: memory allocation failure in jasmalloc jasmalloc.c bsc1006599 - CVE-2016-8884,CVE-2016-8885: two null pointer dereferences in...
CVE-2016-7862
Adobe Flash Player contains a use-after-free vulnerability (CVE-2016-7862) in versions up to 23.0.0.205–23.0.0.207 and 11.2.202.643–11.2.202.644 that could lead to arbitrary code execution. Exploitation involves SWF handling and is confirmed by multiple advisories; updated builds address the issu...
CVE-2016-7859
Adobe Flash Player versions 23.0.0.205 and earlier, and 11.2.202.643 and earlier, contain a use-after-free vulnerability that could allow remote arbitrary code execution. The issue affects Flash Player across major platforms and was addressed in updated builds: 23.0.0.207 (Flash Player 23.x) and ...
CVE-2016-7858
CVE-2016-7858 is a use-after-free vulnerability in Adobe Flash Player that could allow remote arbitrary code execution. Affected products include Flash Player 23.0.0.205 and earlier and 11.2.202.643 and earlier (Windows/other platforms), with exploitation possible via processing a crafted SWF fil...
[SECURITY] [DSA 3705-1] curl security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3705-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini November 03, 2016 https://www.debian.org/security/faq -...
SUSE-SU-2016:2714-1 Security update for curl
This update for curl fixes the following security issues: - CVE-2016-8624: invalid URL parsing with '' bsc1005646 - CVE-2016-8623: Use-after-free via shared cookies bsc1005645 - CVE-2016-8621: curlgetdate read out of bounds bsc1005642 - CVE-2016-8619: double-free in krb5 code bsc1005638 -...
Design/Logic Flaw
Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016...
CVE-2016-7855
Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016...