Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability (CNVD-2017-30539)

Microsoft Edge is the web browser built into the Windows 10 version. A remote memory corruption vulnerability exists in the JavaScript engine content when the Microsoft Edge scripting engine handles in-memory objects, which can be exploited by an attacker to corrupt memory by executing arbitrary...

Microsoft Edge Scripting Engine CVE-2017-11804 Remote Memory Corruption Vulnerability

Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft ChakraCore Microsoft...

Information disclosure

dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests...

Apple iOS Mail MessageUI Memory Corruption Vulnerability

Apple iOS is an operating system developed by Apple for mobile devices.Mail MessageUI component is one of the mail and SMS components. A memory corruption vulnerability exists in the Mail MessageUI component in Apple iOS versions prior to 11. A remote attacker can exploit this vulnerability to...

USN-3425-1: Apache HTTP Server vulnerability

Hanno Böck discovered that the Apache HTTP Server incorrectly handled Limit directives in .htaccess files. In certain configurations, a remote attacker could possibly use this issue to read arbitrary server memory, including sensitive information. This issue is known as Optionsbleed...

Microsoft Windows Kernel - win32k!NtGdiEngCreatePalette Stack Memory Disclosure

Microsoft Windows Kernel - win32k!NtGdiEngCreatePalette Stack Memory Disclosure / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1276&desc=2 We have discovered that the nt!NtGdiEngCreatePalette system call discloses large portions of uninitialized kernel stack memory to user-mo...

Microsoft Edge Memory Corruption Vulnerability (CNVD-2017-28324)

Microsoft Windows 10 and Windows Server 2016 are both products of Microsoft Corporation USA. The former is a set of operating systems for personal computers and the latter is a set of server operating systems.Edge is one of the default browsers that comes with the system.Scripting engine is one o...

Google Android Qualcomm Automotive multimedia competitive conditions vulnerability

Android is a Linux-based open source operating system developed by Google and the Open Handheld Alliance OHA, and Qualcomm Automotive multimedia is a Qualcomm automotive multimedia component used in it. A competitive condition vulnerability exists in Qualcomm Automotive multimedia in Android. An...

The vulnerability in the IMS multimedia message transmission subsystem of the RCS standard in the Android CAF-release operating system allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the IMS multimedia message transmission subsystem of the RCS standard in the Android operating system’s CAF builds is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and...

GraphicsMagick Denial of Service Vulnerability (CNVD-2017-28583)

GraphicsMagick is a simple set of image processing tools. The tool provides resizing, rotating, highlighting and other functions to images. A security vulnerability exists in the 'MagickFree' function in the magick/memory.c file in GraphicsMagick 1.3.26. A remote attacker can exploit this...

Microsoft Edge Scripting Engine Memory Corruption (CVE-2017-8670)

A remote code execution Vulnerability exists in Microsoft Edge. The vulnerability is due to the way JavaScript engine renders when handling objects in memory. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a specially crafted web page...

Updated gstreamer1.0 packages fix security vulnerability

A crafted AVI file could have caused an invalid memory read, possibly causing DoS or corruption CVE-2017-5838...

SUSE-SU-2017:2200-1 Security update for subversion

This update for subversion fixes the following issues: - CVE-2017-9800: A malicious, compromised server or MITM may cause svn client to execute arbitrary commands by sending repository content with svn:externals definitions pointing to crafted svn+ssh URLs. bsc1051362 - Malicious user may commit...

Mozilla Firefox and Firefox ESR Memory Misreference Vulnerability (CNVD-2017-22580)

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A memory misreference vulnerability exists in Mozilla Firefox versions prior to 55 and Firefox ES...

CVE-2017-8620

Windows Search in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when it improperly handles objects in memory, aka "Windows...

CVE-2017-8669

Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to Microsoft browsers...

The vulnerability of Microsoft Excel editors allows a hacker to inject arbitrary code.

The vulnerability of Microsoft Excel editors relates to the handling of objects in memory. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely...

Debian DLA-1028-1 : apache2 security update

Robert Swiecki discovered that the value placeholder in Proxy-Authorization Digest headers were not initialized or reset before or between successive key=value assignments in Apache 2's modauthdigest module Providing an initial key with no '=' assignment could reflect the stale value of...

kitto denial of service vulnerability

kitto is an interactive dashboard framework written using Elixir. A security vulnerability exists in kitto's processing memory, allowing remote attackers to exploit the vulnerability to submit special requests and obtain sensitive information...

The vulnerability of the CURLFile service implementation in the ext/curl/curl_file.c file of the PHP interpreter allows a attacker to cause a service failure or exert other effects.

The vulnerability of the CURLFile service implementation in the ext/curl/curlfile.c file of the PHP interpreter relates to the use of memory after it is freed. Exploiting this vulnerability may allow a malicious actor, operating remotely, to cause service failures or other effects through special...