CVE-2016-5688

The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger 1 a heap-based buffer overflow in the SetPixelIndex function or an invali...

Cumulative Update for Windows 10 Version 1607 and Windows Server 2016: December 9, 2016

None None...

PT-2016-7559

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.17 through 2.4.23 Description The issue is related to the mod http2 module in the Apache HTTP Server, which does not restrict request-header length when the Protocols configuration includes h2 or h2c. This allow...

SOL49820145 - Apache Tomcat vulnerability CVE-2016-8735

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

openSUSE Security Update : virtualbox (openSUSE-2016-1366)

This update for virtualbox fixes the following issues : - Fixes CVE-2016-5501,CVE-2016-5538,CVE-2016-5605,CVE-2016-5608, CVE-2016-5610,CVE-2016-5611,CVE-2016-5613 bsc1005621 - Add patch to limit number of simultaneous make jobs. - Version bump to 5.1.8 released 2016-10-18 by Oracle This is a...

Pushwoosh: Bypass the resend limit in Send Invites

Attacker was able to bypass the limit in user invites...

kernel: Fork of large process causes memory corruption

It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms. All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit o...

CVE-2016-8910

The rtl8139cplustransmit function in hw/net/rtl8139.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and CPU consumption by leveraging failure to limit the ring descriptor count...

ALPINE-CVE-2016-8668

The rockeriowritel function in hw/net/rocker/rocker.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service out-of-bounds read and QEMU process crash by leveraging failure to limit DMA buffer size...

CVE-2016-8576

The xhciringfetch function in hw/usb/hcd-xhci.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash by leveraging failure to limit the number of link Transfer Request Blocks TRB to process...

kernel: pipe: limit the per-user amount of pages allocated in pipes

It is possible for a single process to cause an OOM condition by filling large pipes with data that are never read. A typical process filling 4096 pipes with 1 MB of data will use 4 GB of memory and there can be multiple such processes, up to a per-user-limit...

kernel: File descriptors passed over unix sockets are not properly accounted

It was found that the Linux kernel did not properly account file descriptors passed over the unix socket against the process limit. A local user could use this flaw to exhaust all available memory on the system...

kernel: pipe: limit the per-user amount of pages allocated in pipes

It is possible for a single process to cause an OOM condition by filling large pipes with data that are never read. A typical process filling 4096 pipes with 1 MB of data will use 4 GB of memory and there can be multiple such processes, up to a per-user-limit...

kernel: File descriptors passed over unix sockets are not properly accounted

It was found that the Linux kernel did not properly account file descriptors passed over the unix socket against the process limit. A local user could use this flaw to exhaust all available memory on the system...

Unable to enroll more than two devices per user to XenMobile Server

When trying to enroll an iOS device with an user account that already has 2 devices enrolled, the enrollment would fail during the 2nd profile installation, with the following error message :Profile installation failed -A connection to the server could not be established On Android, the same...

Micro Focus Rumba FTP Client 4.x Stack Overflow

Exploit Title: Rumba FTP Client 4.x stack overflow SEH Date: 29-10-2016 Exploit Author: Umit Aksu Vendor Homepage: http://community.microfocus.com/microfocus/mainframesolutions/rumba/w/knowledgebase/28731.rumba-ftp-4-x-security-update.aspx Software Link:...

CVE-2016-8339

A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG S...

SOL38110373 - Apache Tomcat vulnerability CVE-2014-7810

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Shopify: race condition in adding team members

The researcher reported a race condition when adding new staff members that would allow bypassing the staff account limit for all plans. We fixed this issue by adding an exclusive lock around the account creation process. Note: Shopify no longer accepts reports regarding race conditions bypassing...

FreePBX Recordings Backdoor Upload

Added: 10/14/2016 Background FreePBX is a web-based open-source graphical user interface used to manage Asterisk PBX, an open-source communication server. The FreePBX System Recordings module allows playback of recorded files. Problem The System Recordings module in FreePBX 13 and 14 is vulnerabl...