189 matches found
CVE-2017-2221
CVE-2017-2221 affects Baidu IME Installer (versions 3.6.1.6 and earlier). The vulnerability is an untrusted DLL search path that may allow arbitrary code execution with the privileges of the user invoking the installer when a malicious DLL is present in an unspecified directory. Documented impact...
CVE-2017-2221
Untrusted search path vulnerability in Installer of Baidu IME Ver3.6.1.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...
Installer of Baidu IME may insecurely load Dynamic Link Libraries
Overview Installer of Baidu IME contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Eili Masami of Tachibana Lab. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...
JVN#17788774: Installer of Baidu IME may insecurely load Dynamic Link Libraries
Installer of Baidu IME contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Use the latest installer Use the latest installer according...
CVE-2017-8566
Microsoft Windows 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Windows Input Method Editor IME improperly handling parameters in a method of a DCOM class, aka "Windows IME Elevation of Privilege Vulnerability"...
CVE-2017-8566
Microsoft Windows 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Windows Input Method Editor IME improperly handling parameters in a method of a DCOM class, aka "Windows IME Elevation of Privilege Vulnerability"...
CVE-2017-8566
CVE-2017-8566 is a Windows IME elevation-of-privilege vulnerability in which Windows IME improperly handles parameters in a DCOM class method. A locally authenticated attacker could exploit it by running a crafted application to gain higher privileges. Affected: Windows 1607, 1703, and Windows Se...
Windows IME Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Windows Input Method Editor IME when IME improperly handles parameters in a method of a DCOM class. The DCOM server is a Windows component installed regardless of which languages/IMEs are enabled. An attacker can instantiate the DCOM class and...
JVN#21627267: Microsoft IME may insecurely load Dynamic Link Libraries
Microsoft IME, bundled with Microsoft Windows, contains an issue in loading DLLs. When some application programs are invoked, they may initiate Microsoft IME. This IME, when initiated, checks a certain registry key for a file path to a DLL file and loads it. This registry key does not exist by...
CVE-2017-7752
A use-after-free vulnerability during specific user interactions with the input method editor IME in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. This vulnerability affects Firefox 54, Firefox...
SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:1445-1)
This update for java-180-openjdk fixes the following issues : - Upgrade to version jdk8u131 icedtea 3.4.0 - bsc1034849 - Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110,...
MS11-088: Description of the security update for Microsoft Pinyin IME 2010 for Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1: December 13, 2011
MS11-088: Description of the security update for Microsoft Pinyin IME 2010 for Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1: December 13, 2011 Introduction Microsoft has released security bulletin MS11-088. To view the complete security bulletin, visit one of the following...
Microsoft Windows IME Elevation of Privilege (MS16-130: CVE-2016-7221)
An elevation of privilege vulnerability exists in Windows Input Method Editor IME. The vulnerability is due to the way Input Method Editor improperly handles DLL loading. A locally authenticated attacker can exploit this vulnerability by running a specially crafted application...
Security update for MozillaFirefox (important)
MozillaFirefox is updated to version 50.0.2 which fixes the following issues: Firefox crashed with 3rd party Chinese IME when using IME text fixed in version 50.0.1 Redirection from an HTTP connection to a data: URL could inherit wrong origin after an HTTP redirect fixed in version 50.0.1,...
Privilege escalation
Input Method Editor IME in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 mishandles DLL loading, which allows local users to gain privileges via...
CVE-2016-7221
CVE-2016-7221 is a Windows IME DLL-loading privilege-escalation issue. The IME loads DLLs via a registry-controlled mechanism and can be exploited by a locally authenticated user to gain higher privileges when an application initiates the IME. Public writeups (e.g., JVN/JVND) describe the exploit...
CVE-2016-7221
Input Method Editor IME in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 mishandles DLL loading, which allows local users to gain privileges via...
Microsoft Windows IME Elevation of Privilege Vulnerability
Microsoft Windows is a series of operating systems released by the American company Microsoft. An elevation of privilege vulnerability exists in Windows when the Windows Input Method Editor IME incorrectly handles DLL loading. If the IME is not present, there is no impact. A local, authenticated...