KLA10876 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, bypass security restrictions or obtain sensitive information. Below is a complete list of vulnerabilities 1. An improper value...

SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)

This update for squid3 fixes the following issues : - Multiple issues in pinger ICMP processing. CVE-2014-7141, CVE-2014-7142 - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. bsc973782 - CVE-2016-4554: fix header smuggling issue in HTTP Request processing bsc979010 - fix multipl...

PHP 7 is due: the deserialization vulnerability case studies and analysis of on-vulnerability warning-the black bar safety net

! 1. Vulnerability history For hackers, if you can use a server-side error, that's the equivalent of hit the jackpot. Because users tend to move their data stored in the server,if a hacker can make use of this error can be directed to a target, thereby acquiring greater benefits. PHP scripting...

SUSE-SU-2016:2190-1 Security update for fontconfig

This update for fontconfig fixes the following issues: - security update: CVE-2016-5384: Possible double free due to insufficiently validated cache files bsc992534...

SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)

This update for php53 to version 5.3.17 fixes the following issues : These security issues were fixed : - CVE-2016-5093: geticuvalueinternal out-of-bounds read bnc982010. - CVE-2016-5094: Don't create strings with lengths outside int range bnc982011. - CVE-2016-5095: Don't create strings with...

CVE-2015-8949

CVE-2015-8949 is a use-after-free vulnerability in the MySQL driver for Perl (DBD::mysql) affecting versions before 4.033_01, triggered by a faulty path in the my_login flow that allows an unspecified impact. The issue is noted in multiple advisories and CVE lists, with references across NVD, Gen...

CVE-2014-9906

CVE-2014-9906 describes a use-after-free vulnerability in the Perl DBD::mysql module prior to version 4.029. The issue arises from improper memory handling, allowing a remote attacker to cause a denial of service (crash) and potentially execute arbitrary code via vectors related to a lost server ...

[SECURITY] [DLA 587-1] fontconfig security update

Package : fontconfig Version : 2.9.0-7.1+deb7u1 CVE ID : CVE-2016-5384 Debian Bug : 833570 A possible double free vulnerability was found in fontconfig. The problem was due to insufficient validation when parsing the cache file. For Debian 7 "Wheezy", these problems have been fixed in version...

CVE-2015-0568

Use-after-free vulnerability in the msmsetcrop function in drivers/media/video/msm/msmcamera.c in the MSM-Camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a...

OPENSUSE-SU-2016:1983-1 Security update for Chromium

Chromium was updated to 52.0.2743.116 to fix the following security issues: boo992305 - CVE-2016-5141: Address bar spoofing boo992314 - CVE-2016-5142: Use-after-free in Blink boo992313 - CVE-2016-5139: Heap overflow in pdfium boo992311 - CVE-2016-5140: Heap overflow in pdfium boo992310 -...

CVE-2016-5772

Double free vulnerability in the phpwddxprocessdata function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via crafted XML data that is...

CVE-2016-3132

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spldllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index...

CVE-2016-5772

Removed by vendor...

CVE-2016-5772

Double free vulnerability in the phpwddxprocessdata function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via crafted XML data that is...

CVE-2016-3132

CVE-2016-3132: A double free vulnerability in PHP’s SplDoublyLinkedList::offsetSet (ext/spl/spl_dllist.c) affects PHP 7.x prior to 7.0.6. Exploitation via a crafted index allows remote code execution. The affected software is PHP 7.x before 7.0.6; the root cause is the double free in the offsetSe...

CVE-2016-5768

Double free vulnerability in the phpmbregexeregreplaceexec function in phpmbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service application crash by leveraging a callback...

CVE-2016-5254

Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service heap memory corruption and application crash by leveraging keyboard access to use the Alt...

Design/Logic Flaw

Use-after-free vulnerability in the js::PreliminaryObjectArray::sweep function in Mozilla Firefox before 48.0 allows remote attackers to execute arbitrary code via crafted JavaScript that is mishandled during incremental garbage collection...

CVE-2016-5264

CVE-2016-5264 affects Mozilla Firefox (and Firefox ESR) with a use-after-free in nsNodeUtils::NativeAnonymousChildListChange when applying SVG effects. The vulnerability can allow remote code execution or cause a denial of service via heap memory corruption. It is described for Firefox versions p...

FreeBSD : The GIMP -- Use after Free vulnerability (6fb8a90f-c9d5-4d14-b940-aed3d63c2edc)

The GIMP team reports : A Use-after-free vulnerability was found in the xcfloadimage function. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and...