CVE-2018-11738

An issue was discovered in libtskfs.a in The Sleuth Kit TSK from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function ntfsmakedatarun in tsk/fs/ntfs.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped...

Google Chrome WebRTC out-of-bounds memory access vulnerability (CNVD-2018-11492)

Google Chrome is a web browser developed by Google, Inc. WebRTC is a component of the browser that supports real-time voice or video conversations. A security vulnerability exists in WebRTC in versions of Google Chrome prior to 67.0.3396.62. A remote attacker can exploit this vulnerability by...

Google Chrome out-of-bounds memory access vulnerability (CNVD-2018-12606)

Google Chrome is the United States Google Google company developed a Web browser. v8 is one of the open source JavaScript engine. A security vulnerability exists in V8 in versions of Google Chrome prior to 67.0.3396.62. A remote attacker can exploit this vulnerability by tricking a user into...

CVE-2017-16026

Request is an http client. If a request is made using multipart, and the body type is a number, then the specified number of non-zero memory is passed in the body. This affects Request =2.2.6 2.51.0 =2.67.0...

CVE-2018-7534

In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory...

The vulnerability of the Android operating system, related to the operation of data beyond the buffer in memory, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Android operating system arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

openSUSE Security Update : apache2 (openSUSE-2018-438)

This update for apache2 fixes the following issues : - CVE-2018-1283: when modsession is configured to forward its session data to CGI applications SessionEnv on, not the default, a remote user may influence their content by using a 'Session' header leading to unexpected behavior bsc1086814. -...

CVE-2018-8123

An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-1021...

Microsoft Excel Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with...

Security Updates for Internet Explorer (May 2018)

The Internet Explorer installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited...

GPU memory module security bypass vulnerability

A GPU Graphics Processing Unit memory module is a GPU memory module. A security vulnerability exists in the GPU memory module. An attacker can exploit this vulnerability to bypass security restrictions and perform unauthorized operations by using the JavaScript WebGL API...

Memory out-of-bounds access vulnerability in Hikvision Player SDK (for Windows x32)

Hikvision Playback Library SDK hereinafter referred to as "Player SDK" is a secondary development kit for playback of Hikvision embedded network DVRs, video servers, and IP devices. A memory out-of-bounds access vulnerability exists in the Hikvision Player SDK for Windows x32. The vulnerability i...

CVE-2018-10229

A hardware vulnerability in GPU memory modules allows attackers to accelerate micro-architectural attacks through the use of the JavaScript WebGL API...

CVE-2018-10115

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service segmentation fault or execute arbitrary code via a crafted RAR archive...

CVE-2018-10545

An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpmunix.c makes a PRSETDUMPABLE prctl call, allowing one user in a multiuser environment to obtain sensitive...

The vulnerability of the Microsoft Office software package arises from improper handling of objects in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Microsoft Office suite arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted file...

OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: AWT. Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2018-3850

CVE-2018-3850 is a use-after-free vulnerability in Foxit Software’s Foxit PDF Reader JavaScript engine (v9.0.1.1049) that can be triggered by opening a specially crafted PDF. The issue reuses a previously freed memory object, allowing arbitrary code execution. Attack requires user interaction (op...

Foxit PDF Reader JavaScript setPersistent Remote Code Execution Vulnerability

Summary An exploitable use of an uninitialized pointer vulnerability exists in the JavaScript engine in Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF document can lead to a dereference of an uninitialized pointer which, if under attacker control, can result in arbitrary code...

CVE-2015-9208

CVE-2015-9208 affects Android on Qualcomm Snapdragon devices (various SoCs listed). The vulnerability arises because tzbsp_pil_verify_sig() does not strictly constrain the ELF/program headers and hash segment pointers to secure memory; it only ensures addresses are not in non-secure memory, allow...