CVE-2018-14441: Unrestricted Upload of File with Dangerous Type

An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. admin/admin/fileUploadActionfileUpload.action allows arbitrary file upload, as demonstrated by a .jsp file with the image/jpeg content type...

Debian DLA-1433-1 : openjpeg2 security update

CVE-2015-1239 Fix for denial of service process crash via a crafted PDF. CVE-2016-5139 Fix for integer overflows, allowing a denial of service heap-based buffer overflow or possibly have unspecified other impact via crafted JPEG 2000 data. For Debian 8 'Jessie', these problems have been fixed in...

[SECURITY] [DLA 1433-1] openjpeg2 security update

Package : openjpeg2 Version : 2.1.0-2+deb8u4 CVE ID : CVE-2015-1239 CVE-2016-5139 CVE-2015-1239 Fix for denial of service process crash via a crafted PDF. CVE-2016-5139 Fix for integer overflows, allowing a denial of service heap-based buffer overflow or possibly have unspecified other impact via...

Internet Bug Bounty: heap-buffer-overflow (READ of size 48) in exif_read_data()

exifreaddata in PHP 5.6.36, 7.1.x and 7.2.x is vulnerable to a heap buffer overflow when fed a specially crafted JPEG. Any online service that reads EXIF data from uploaded JPEGs is potentially vulnerable to this flaw. This has been fixed with the release of PHP 7.2.8 today. Other releases are...

Adobe Acrobat Pro DC ImageConversion XPS JPEG Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Acrobat Pro DC ImageConversion EMF JPEG Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

Adobe Acrobat Pro DC ImageConversion XPS JPEG Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

[SECURITY] Fedora 28 Update: libjpeg-turbo-1.5.3-6.fc28

The libjpeg-turbo package contains a library of functions for manipulating JPEG images...

USN-3706-2: libjpeg-turbo vulnerabilities

USN-3706-1 fixed a vulnerability in libjpeg-turbo. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or automated system were tricked into opening a...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libjpeg-turbo vulnerabilities (USN-3706-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3706-1 advisory. It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or automated system were tricke...

Ubuntu: Security Advisory (USN-3706-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3706-1: libjpeg-turbo vulnerabilities

It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or automated system were tricked into opening a specially crafted JPEG image, a remote attacker could cause libjpeg-turbo to crash, resulting in a denial of service, or possibly execute arbitrary cod...

Debian DSA-4240-1 : php7.0 - security update

Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language : - CVE-2018-7584 Buffer underread in parsing HTTP responses - CVE-2018-10545 Dumpable FPM child processes allowed the bypass of opcache access controls - CVE-2018-10546 Denial of service via...

[SECURITY] [DSA 4240-1] php7.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4240-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 05, 2018 https://www.debian.org/security/faq -...

Unspecified vulnerability in jpeg-compressor

jpeg-compressor is an encoder for generating JPEG format files. A security vulnerability exists in the 'buildhuffman' function of the stbimage.c file in jpeg-compressor version 0.1. An attacker can exploit this vulnerability to cause a denial of service stack buffer overflow and application crash...

Unspecified vulnerability in jpeg-compressor

jpeg-compressor is an encoder for generating JPEG format files. A security vulnerability exists in the 'bmpload' function of the stbimage.c file in jpeg-compressor version 0.1. A remote attacker can exploit this vulnerability to cause a denial of service heap buffer overflow and application crash...

Taking apart a double zero-day sample discovered in joint hunt with ESET

In late March 2018, I analyzed an interesting PDF sample found by ESET senior malware researcherAnton Cherepanov. The sample was initially reported to Microsoft as a potential exploit for an unknown Windows kernel vulnerability. During my investigation in parallel with ESET researchers, I was...

EulerOS 2.0 SP3 : exempi (EulerOS-SA-2018-1173)

According to the version of the exempi package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service invalid memcpy with resultant use-after-free...

Heap overflow

An issue was discovered in jpeg-compressor 0.1. The bmpload function in stbimage.c allows remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact...

CVE-2018-13037

An issue was discovered in jpeg-compressor 0.1. The bmpload function in stbimage.c allows remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact...