PT-2018-2650

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.37 PHP versions 7.0.x prior to 7.0.31 PHP versions 7.1.x prior to 7.1.20 PHP versions 7.2.x prior to 7.2.8 Description The issue is related to the exif process IFD in MAKERNOTE function in the ext/exif/exif.c file,...

UBUNTU-CVE-2018-14851

exifprocessIFDinMAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted JPEG file...

DEBIAN-CVE-2016-9573

An out-of-bounds read vulnerability was found in OpenJPEG 2.1.2, in the j2ktoimage tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or, potentially, disclose some data from the heap...

Heap Overflow

libgdkpixbuf-2.0.so is vulnerable to heap overflows. A malicious user can pass a jpeg file to the gdkpixbufjpegimageloadincrement function in io-jpeg.c, causing a heap overflow that can crash the application or cause arbitrary code to be executed...

Design/Logic Flaw

An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. admin/admin/fileUploadActionfileUpload.action allows arbitrary file upload, as demonstrated by a .jsp file with the image/jpeg content type...

Debian DLA-1433-1 : openjpeg2 security update

CVE-2015-1239 Fix for denial of service process crash via a crafted PDF. CVE-2016-5139 Fix for integer overflows, allowing a denial of service heap-based buffer overflow or possibly have unspecified other impact via crafted JPEG 2000 data. For Debian 8 'Jessie', these problems have been fixed in...

CVE-2018-14441: Unrestricted Upload of File with Dangerous Type

An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. admin/admin/fileUploadActionfileUpload.action allows arbitrary file upload, as demonstrated by a .jsp file with the image/jpeg content type...

[SECURITY] [DLA 1433-1] openjpeg2 security update

Package : openjpeg2 Version : 2.1.0-2+deb8u4 CVE ID : CVE-2015-1239 CVE-2016-5139 CVE-2015-1239 Fix for denial of service process crash via a crafted PDF. CVE-2016-5139 Fix for integer overflows, allowing a denial of service heap-based buffer overflow or possibly have unspecified other impact via...

Internet Bug Bounty: heap-buffer-overflow (READ of size 48) in exif_read_data()

exifreaddata in PHP 5.6.36, 7.1.x and 7.2.x is vulnerable to a heap buffer overflow when fed a specially crafted JPEG. Any online service that reads EXIF data from uploaded JPEGs is potentially vulnerable to this flaw. This has been fixed with the release of PHP 7.2.8 today. Other releases are...

PT-2018-2553

Name of the Vulnerable Software and Affected Versions Libgd version 2.2.5 Description The issue is related to a Double Free Vulnerability in the gdImageBmpPtr function, which can result in Remote Code Execution. This can be triggered by a specially crafted JPEG image, causing a double free. The...

Adobe Acrobat Pro DC ImageConversion EMF JPEG Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

Adobe Acrobat Pro DC ImageConversion XPS JPEG Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Acrobat Pro DC ImageConversion XPS JPEG Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

[SECURITY] Fedora 28 Update: libjpeg-turbo-1.5.3-6.fc28

The libjpeg-turbo package contains a library of functions for manipulating JPEG images...

USN-3706-2: libjpeg-turbo vulnerabilities

USN-3706-1 fixed a vulnerability in libjpeg-turbo. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or automated system were tricked into opening a...

PT-2018-16727

Name of the Vulnerable Software and Affected Versions Adobe Acrobat and Reader versions 2018.011.20040 and earlier Adobe Acrobat and Reader versions 2017.011.30080 and earlier Adobe Acrobat and Reader versions 2015.006.30418 and earlier Description The issue is related to an out-of-bounds read,...

Ubuntu: Security Advisory (USN-3706-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libjpeg-turbo vulnerabilities (USN-3706-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3706-1 advisory. It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or automated system were tricke...

USN-3706-1: libjpeg-turbo vulnerabilities

It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or automated system were tricked into opening a specially crafted JPEG image, a remote attacker could cause libjpeg-turbo to crash, resulting in a denial of service, or possibly execute arbitrary cod...

Debian DSA-4240-1 : php7.0 - security update

Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language : - CVE-2018-7584 Buffer underread in parsing HTTP responses - CVE-2018-10545 Dumpable FPM child processes allowed the bypass of opcache access controls - CVE-2018-10546 Denial of service via...