JVN#94056834: Installer of HIBUN Confidential File Viewer may insecurely load Dynamic Link Libraries and invoke executable files

Installer of HIBUN Confidential File Viewer provided by Hitachi Solutions, Ltd. contains an issue with the search path for DLL/executable files, which may lead to insecurely loading Dynamic Link Libraries and invoking executable files CWE-427. Impact Arbitrary code may be executed with the...

PostgreSQL 10 Installer For Windows DLL Hijacking Vulnerability

The PostgreSQL 10 installer for Windows suffers from a dll hijacking vulnerability. Hi @ll, the executable installers of PostgreSQL 10 for Windows, 1. PostgreSQL-10.0-1-win64-bigsql.exe, available from via , 2. postgresql-10.0-1-windows.exe and postgresql-10.0-1-windows-x64.exe, available from vi...

Install program and Installer of i-filter 6.0 may insecurely load Dynamic Link Libraries and invoke executable files

Overview i-filter 6.0 provided by Digital Arts Inc. is web filtering and parental control software. The install program is designed to download the installer via the internet and execute it. The i-filter 6.0 install program and installer contain the following vulnerabilities. Eili Masami of...

Debian DLA-1114-1 : ruby1.9.1 security update

Multiple vulnerabilities were discovered in the Ruby 1.9 interpretor. CVE-2017-0898 Buffer underrun vulnerability in Kernel.sprintf CVE-2017-0899 ANSI escape sequence vulnerability CVE-2017-0900 DOS vulernerability in the query command CVE-2017-0901 gem installer allows a malicious gem to overwri...

Debian DLA-1112-1 : rubygems security update

Some vulnerabilities were found in the Rubygems package that affects the LTS distribution. CVE-2017-0900 DOS vulernerability in the query command CVE-2017-0901 gem installer allows a malicious gem to overwrite arbitrary files For Debian 7 'Wheezy', these problems have been fixed in version...

[SECURITY] [DLA 1114-1] ruby1.9.1 security update

Package : ruby1.9.1 Version : 1.9.3.194-8.1+deb7u6 CVE ID : CVE-2017-0898 CVE-2017-0899 CVE-2017-0900 CVE-2017-0901 CVE-2017-10784 CVE-2017-14033 CVE-2017-14064 Debian Bug : 873802 873906 875928 875931 875936 Multiple vulnerabilities were discovered in the Ruby 1.9 interpretor. CVE-2017-0898 Buff...

SCUTUM - Linux Automatic ARP (TCP / UDP / ICMP) Firewall

SCUTUM - Linux Automatic ARP TCP / UDP / ICMP Firewall Current Version Change log: 1. Added Self-Upgrading Function, now users can execute self-upgrading with $ sudo scutum --upgrade 2. Added AVALON Framework Self-Upgrading function included when using "--upgrade" parameter Recent Changes: 1...

Digital Arts i-filter untrustworthy search path vulnerability

Digital Arts i-filter is a parental control web filter from Digital Arts Japan. installer is one of the installers. An untrusted search path vulnerability exists in the installer of Digital Arts i-filter version 6.0. The vulnerability can be exploited to gain privileges via a malicious DLL in the...

Digital Arts i-filter untrustworthy search path vulnerability

Digital Arts i-filter is a parental control web filter from Digital Arts Japan. installer is one of the installers. An untrusted search path vulnerability exists in the installer of Digital Arts i-filter version 6.0. The vulnerability can be exploited to gain privileges via a malicious DLL in the...

Lhaz+ untrustworthy search path vulnerability

Lhaz+ is a compression/decompression tool. installer is one of the installers. An untrusted search path vulnerability exists in the installer in Lhaz+ 3.4.0 and earlier versions. A remote attacker can exploit this vulnerability to gain privileges with a malicious DLL in the directory...

RubyGems: Installer can modify other gems if gem name is specially crafted

Installer can modify other gems if gem name is specially crafted The installlocation function allows writing to certain files outside the installation directory. The installlocation function in lib/rubygems/package.rb attempts to ensure that files are not installed outside destinationdir. However...

Fedora 25 : ruby (2017-e136d63c99)

Fix ANSI escape sequence vulnerability CVE-2017-0899. - Fix DoS vulnerability in the query command CVE-2017-0900. - Fix a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files CVE-2017-0901. - Fix DNS request hijacking vulnerability CVE-2017-0902. - Fix...

CVE-2017-10858

Untrusted search path vulnerability in "i-filter 6.0 install program" file version 1.0.8.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-10859

Untrusted search path vulnerability in "i-filter 6.0 installer" timestamp of code signing is before 23 Aug 2017 JST allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in "i-filter 6.0 installer" timestamp of code signing is before 23 Aug 2017 JST allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-10859

Untrusted search path vulnerability in "i-filter 6.0 installer" timestamp of code signing is before 23 Aug 2017 JST allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-10860

Untrusted search path vulnerability in "i-filter 6.0 installer" timestamp of code signing is before 23 Aug 2017 JST allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory...

CVE-2017-10860

CVE-2017-10860 affects i-filter 6.0 installer/installer components from Digital Arts. The issue is an untrusted search path vulnerability in the installer’s code signing timestamp (before 23 Aug 2017 JST) that can allow arbitrary code execution via a specially crafted executable in an unspecified...

CVE-2017-10859

CVE-2017-10859 corresponds to an untrusted search path vulnerability in Digital Arts’ i-filter 6.0 installer. The code-signing timestamp before 23 Aug 2017 (JST) enables privilege escalation via a Trojan DLL located in an unspecified directory, potentially allowing arbitrary code execution with t...

Installer of FENCE-Explorer may insecurely load Dynamic Link Libraries and invoke executable files

Overview FENCE-Explorer provided by FUJITSU BROAD SOLUTION & CONSULTING Inc. is a tool to view and edit a file in "FENCE Briefcase" which is created by FENCE-Pro and other FENCE series software. Installer of FENCE-Explorer contains an issue with the search path for DLL/executable files, which may...