Oracle OIT IX SDK TIFF file parsing heap buffer overflow(CVE-2016-3582)

Description While parsing a specially crafted TIFF file, a parser confusion can lead to a heap buffer overflow resulting in out of bounds memory overwrite and possibly leading to arbitrary code execution. Tested Versions Outside In IX sdk 8.5.1. Product URLs...

Oracle OIT IX SDK libvs_pdf Xref Offset Denial of Service Vulnerability(CVE-2016-3580)

Description A vulnerability in PDF parser of the IX SDK exists that results in out of bounds heap memory access following an unchecked memory allocation operation under specific conditions. Tested Versions Oracle Outside In IX sdk 8.5.1 Product URLs...

Cisco IOS and IOS XE Software iox Command Injection Vulnerability

Cisco IOS and IOS XE are both operating systems developed by Cisco for its network devices. ixox is one of the application support system components that provides application hosting capabilities end-to-end. A command injection vulnerability exists in the ix command in Cisco IOS and IOS XE...

Oracle OIT IX SDK libvs_pdf Xref Offset Denial of Service Vulnerability

Talos Vulnerability Report TALOS-2016-0102 Oracle OIT IX SDK libvspdf Xref Offset Denial of Service Vulnerability July 19, 2016 CVE Number CVE-2016-3580 Description A vulnerability in PDF parser of the IX SDK exists that results in out of bounds heap memory access following an unchecked memory...

Oracle OIT IX SDK libvs_pdf Root xref Denial of Service Vulnerabiity

Talos Vulnerability Report TALOS-2016-0099 Oracle OIT IX SDK libvspdf Root xref Denial of Service Vulnerabiity July 19, 2016 CVE Number CVE-2016-3577 DESCRIPTION A stack overflow leading to a crash due to unbounded recusive function call is present in the PDF file format parsing code of the IX SD...

Oracle OIT IX SDK TIFF file parsing heap buffer overflow

Talos Vulnerability Report TALOS-2016-0104 Oracle OIT IX SDK TIFF file parsing heap buffer overflow July 19, 2016 CVE Number CVE-2016-3582 Description While parsing a specially crafted TIFF file, a parser confusion can lead to a heap buffer overflow resulting in out of bounds memory overwrite and...

Oracle OIT IX SDK libvs_pdf arbitrary pointer access

Talos Vulnerability Report TALOS-2016-0101 Oracle OIT IX SDK libvspdf arbitrary pointer access July 19, 2016 CVE Number CVE-2016-3579 Description When parsing a specially crafted PDF document, a value derived from a file is used as a memory pointer leading to a process crash. Tested Versions...

Oracle OIT IX SDK TIFF ExtraSamples Code Execution Vulnerabiity

Talos Vulnerability Report TALOS-2016-0103 Oracle OIT IX SDK TIFF ExtraSamples Code Execution Vulnerabiity July 19, 2016 CVE Number CVE-2016-3581 Description While parsing a specially crafted TIFF file, a parser confussion can lead to a heap buffer overflow resulting in out of bounds memory...

Oracle OIT IX SDK GIF ImageWidth Code Execution Vulnerabiity

Talos Vulnerability Report TALOS-2016-0105 Oracle OIT IX SDK GIF ImageWidth Code Execution Vulnerabiity July 19, 2016 CVE Number CVE-2016-3583 Description While parsing a specially crafted GIF file, an integer overflow vulnerability and result in out of bounds heap memory overwrite potentially...

Oracle OIT IX SDK libvs_pdf Kids List Information Leak

Talos Vulnerability Report TALOS-2016-0096 Oracle OIT IX SDK libvspdf Kids List Information Leak July 19, 2016 CVE Number CVE-2016-3574 DESCRIPTION When parsing a specially crafted PDF document, the parser is expecting a pointer where string is located leading to a read access violation with a...

Oracle IOT IX SDK libvs_pdf XRef Index Code Execution Vulnerability

Talos Vulnerability Report TALOS-2016-0086 Oracle IOT IX SDK libvspdf XRef Index Code Execution Vulnerability April 19, 2016 CVE Number CVE-2016-3455 DESCRIPTION A vulnerability in PDF parser of the IX SDK exists that allows an out of bounds heap memory overwrite potentially leading to remote cod...

CVE-2015-0611

The administrative web-management portal in Cisco IX 8 .0.1 and earlier on Cisco TelePresence IX5000 devices does not properly restrict the device-recovery account's access, which allows remote authenticated users to obtain HelpDesk-equivalent privileges by leveraging device-recovery...

Authentication flaw

The administrative web-management portal in Cisco IX 8 .0.1 and earlier on Cisco TelePresence IX5000 devices does not properly restrict the device-recovery account's access, which allows remote authenticated users to obtain HelpDesk-equivalent privileges by leveraging device-recovery...

CVE-2015-0611

The CVE affects Cisco TelePresence IX5000 Series (IX 8.x and earlier) where the administrative web management portal fails to properly restrict the device-recovery account. This allows remote authenticated users to gain HelpDesk-equivalent privileges on the web interface due to the recovery accou...

CVE-2015-0611

The administrative web-management portal in Cisco IX 8 .0.1 and earlier on Cisco TelePresence IX5000 devices does not properly restrict the device-recovery account's access, which allows remote authenticated users to obtain HelpDesk-equivalent privileges by leveraging device-recovery...

Code injection

The SIP IX implementation in Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allows remote attackers to cause a denial of service device reload via crafted SDP packets, aka Bug ID CSCuo42252...

Operation High Roller Banked on Fast-Flux Botnet to Steal Millions

A fraud ring that attacked financial transfer systems in an attempt to get at wealthy high-end banking customers used a complicated web of malware and compromised servers in several countries to walk off with an estimated $78 million earlier this year. While the attacks targeted financial systems...

New Ice IX Variant Steals Information From Facebook Users

A new iteration of the Ice IX malware has been spotted attacking Facebook users, according to researchers at Trusteer, who claim that now the malware is trying to swindle unsuspecting users out of sensitive information like credit card numbers and addresses. After launching a web injection, the...

Microsoft, Financial Groups Execute Takedown of Zeus Botnet Servers

Microsoft has gone after another botnet, this time targeting some of the command-and-control infrastructure behind the Zeus network with a takedown effort that included seizing two IP addresses used for C&C servers and filing suit against 39 unnamed defendants. The action against Zeus is the late...

Phishing Campaign Using Spoofed US-CERT Email Addresses

On January 10, 2012, US-CERT received reports of a phishing campaign that is spoofing US-CERT email to deliver a variant of the Zeus/Zbot Trojan known as Ice-IX. This campaign appears to be targeting a large number of private sector organizations as well as federal, state, and local governments...