[SECURITY] Fedora 27 Update: libpng10-1.0.69-5.fc27

The libpng10 package contains an old version of libpng, a library of functi ons for creating and manipulating PNG Portable Network Graphics image format files. This package is needed if you want to run binaries that were linked dynamic ally with libpng 1.0.x...

Security Bulletin: IBM Forms Viewer Installation could allow a remote attacker to execute arbitrary code on the system (CVE-2016-2542)

Summary IBM Forms Viewer Installation could allow a remote attacker to execute arbitrary code on the system. If you have recently downloaded a copy of IBM Forms Viewer, use the information below to correct the vulnerability prior to installing the product. If you have already installed IBM...

Security Bulletin: IBM Forms Designer Installation could allow a remote attacker to execute arbitrary code on the system (CVE-2016-2542)

Summary IBM Forms Designer Installation could allow a remote attacker to execute arbitrary code on the system. If you have recently downloaded a copy of IBM Forms Designer, use the information below to correct the vulnerability prior to installing the product. If you have already installed IBM...

Security Bulletin: IBM Tealeaf Customer Experience installers vulnerable to attack (CVE-2016-2542)

Summary Installation programs for the Microsoft Windows components of IBM Tealeaf Customer Experience are vulnerable to attack under certain conditions. Vulnerability Details CVEID: CVE-2016-2542 DESCRIPTION: Flexera InstallShield could allow a remote attacker to execute arbitrary code on the...

Microsoft Edge Chakra JIT - Bound Check Elimination Bug

Microsoft Edge Chakra JIT - Bound Check Elimination Bug / Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instaed of the control flow. This may lead to incorrectly remove the bound checks. ...

China-Linked APT15 Used Myriad of New Tools To Hack UK Government Contractor

CANCUN, Mexico – Researchers at NCC Group have discovered multiple backdoors on a UK government contractor’s computer systems designed to steal sensitive government and military data. The hack is tied to China-linked cyber espionage group APT15, which researchers said is utilizing many new tools ...

Heap overflow

A Heap Overflow Remote Code Execution issue was discovered in Design Science MathType 6.9c. Crafted input can modify the next pointer of a linked list. This is fixed in 6.9d...

CVE-2018-6640

A Heap Overflow Remote Code Execution issue was discovered in Design Science MathType 6.9c. Crafted input can modify the next pointer of a linked list. This is fixed in 6.9d...

CVE-2018-6640

A Heap Overflow Remote Code Execution issue was discovered in Design Science MathType 6.9c. Crafted input can modify the next pointer of a linked list. This is fixed in 6.9d...

CVE-2018-6640: Out-of-bounds Write

A Heap Overflow Remote Code Execution issue was discovered in Design Science MathType 6.9c. Crafted input can modify the next pointer of a linked list. This is fixed in 6.9d...

‘Olympic Destroyer’ Malware Behind Winter Olympics Cyberattack, Researchers Say

Winter Olympics officials have confirmed that a cyberattack occurred during the games’ opening ceremony on Feb. 9, but are remaining mum on the source of the attack. Researchers say the attack employed malware, dubbed Olympic Destroyer, that was written with the sole intention of destroying...

Rockstar Games: Stored XSS on profile page via Steam display name

The researcher was able to demonstrate a XSS vulnerability by using their Steam nickname as the payload vector. This was due to insufficient filtering on Linked Account name fields. We pushed out an update that replaces suspicious Linked Account names with a generic string in order to prevent...

Linux Kernel AF_PACKET Use-After-Free(CVE-2017-15649)

Vulnerabilities summary The following advisory describes a use-after-free vulnerability found in Linux Kernel’s implementation of AFPACKET that can lead to privilege escalation. AFPACKET sockets “allow users to send or receive packets on the device driver level. This for example lets them to...

Security Kinou Mihariban Untrustworthy Search Path Vulnerability

Security Kinou Mihariban is a security monitoring software from NIPPON TELEGRAPH AND TELEPHONE WEST, Japan. An untrustworthy search path vulnerability exists in Security Kinou Mihariban 1.0.21 and earlier versions. A remote attacker can exploit this vulnerability to gain privileges with the help ...

PT-2017-12921

Name of the Vulnerable Software and Affected Versions ImageMagick versions 7.0.6 through 7.0.8 Description A memory leak issue was discovered in the ReadMIFFImage function, allowing attackers to cause a denial of service by consuming memory via a crafted file. This issue affects the NewLinkedList...

Cyberspies Are Using Leaked NSA Hacking Tools to Spy On Hotels Guests

An infamous Russian-linked cyber-espionage group has been found re-using the same leaked NSA hacking tool that was deployed in the WannaCry and NotPetya outbreaks—this time to target Wi-Fi networks to spy on hotel guests in several European countries. Security researchers at FireEye have uncovere...

Experts Unveil Cyber Espionage Attacks by CopyKittens Hackers

Security researchers have discovered a new, massive cyber espionage campaign that mainly targets people working in government, defence and academic organisations in various countries. The campaign is being conducted by an Iran-linked threat group, whose activities, attack methods, and targets hav...

(Pwn2Own) Microsoft Windows NtUserLinkDpiCursor Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

[ASA-201707-7] libdwarf: denial of service

Arch Linux Security Advisory ASA-201707-7 ========================================= Severity: Low Date : 2017-07-11 CVE-ID : CVE-2017-9998 Package : libdwarf Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-332 Summary ======= The package libdwarf before version...

Researchers Find BlackEnergy APT Links in ExPetr Code

Researchers have found links between the BlackEnergy APT group and threat actors behind the ExPetr malware used in last month’s global attacks. According to researchers at Kaspersky Lab, there are strong similarities between older versions of BlackEnergy’s KillDisk ransomware compared to ExPetr...