RedHat Update for graphite2 RHSA-2017:1793-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

graphite2: out of bounds read in "graphite2::Pass::readPass"

An out of bounds read flaw related to "graphite2::Pass::readPass" has been reported in graphite2. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash...

graphite2: heap-buffer-overflow read "graphite2::Silf::getClassGlyph"

An out of bounds read flaw related to "graphite2::Silf::getClassGlyph" has been reported in graphite2. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash...

graphite2: out of bounds read "graphite2::Silf::readGraphite"

An out of bounds read flaw related to "graphite2::Silf::readGraphite" has been reported in graphite2. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash...

Mail.ru: uninitilized server memory disclosure via ImageMagick in my.mail.ru and cloud.mail.ru

0-day Image Magic application / library vulnerability led to process's uninitialized memory region disclosure via converted image file. Region's address was not directly controlled by attacker. Vulnerability was reported for 2 projects: cloud.mail.ru is in bug bounty scope, but, as a mitigation...

Uninitialized Memory Disclosure

openwhisk is vulnerable to uninitialized memory disclosure. The library initializes a buffer by providing a numeric value to the Buffer class, resulting in a buffer being created with non zero-ed out memory. This can lead to information on the uninitialized memory being disclosed...

Debian DSA-3914-1 : imagemagick - security update

This updates fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed RLE, SVG, PSD, PDB, DPX, MAT, TGA, VST, CIN, DIB, MPC,...

Microsoft Windows Kernel - IOCTL 0x120007 NsiGetParameter nsiproxynetio Pool Memory Disclosure

Microsoft Windows Kernel - IOCTL 0x120007 NsiGetParameter nsiproxynetio Pool Memory Disclosure / We have discovered that the handler of the 0x120007 IOCTL in nsiproxy.sys \.\Nsi device discloses portions of uninitialized pool memory to user-mode clients, likely due to output structure alignment...

CVE-2017-1000066

The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the disclosure of sensitive information...

CVE-2017-0196

Summary: CVE-2017-0196 concerns the Microsoft scripting engine (ChakraCore) exposing information through a heap over-read in the IsMissingItem function when processing crafted web content, enabling a remote attacker to read confidential memory. Affected component: Microsoft ChakraCore JavaScript ...

Vulnerabilities in the Pidgin instant messaging program, which allow a hacker to trigger memory disclosure, as well as the ability to inject arbitrary code

The multiple vulnerabilities related to memory corruption in the Pidgin instant messaging application are linked to the processing of the MXIT protocol. Exploiting these vulnerabilities can allow a remote attacker to trigger memory disclosure and the injection of arbitrary code by sending special...

PHP 7.1.x < 7.1.7 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.7. It is, therefore, affected by the following vulnerabilities : - An out-of-bounds read error exists in the GD Graphics Library LibGD in the gdImageCreateFromGifCtx function within file gdgifin.c...

PHP 5.6.x < 5.6.31 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.31. It is, therefore, affected by the following vulnerabilities : - An out-of-bounds read error exists in the PCRE library in the compilebracketmatchingpath function within file pcrejitcompile.c. An...

PHP 7.0.x < 7.0.21 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.21. It is, therefore, affected by the following vulnerabilities : - An out-of-bounds read error exists in the PCRE library in the compilebracketmatchingpath function within file pcrejitcompile.c. An...

flash-plugin: information disclosure issues fixed in APSB17-21

Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure...

CVE-2017-7529

A flaw within the processing of ranged HTTP requests has been discovered in the range filter module of nginx. A remote attacker could possibly exploit this flaw to disclose parts of the cache file header, or, if used in combination with third party modules, disclose potentially sensitive memory b...

Debian Security Advisory DSA 3907-1 (spice - security update)

Frediano Ziglio discovered a buffer overflow in spice, a SPICE protocol client and server library which may result in memory disclosure, denial of service and potentially the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb3907.nasl 6906 2017-08-11 13:21:18Z cfischer $...

Microsoft Windows Graphics Information Disclosure (CVE-2017-0288)

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system...

Debian: Security Advisory (DSA-3907-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

XSS Vulnerability in HYBBS 1.5.34 CMS

HYBBS is based on HYPHP framework, the framework is a MVC structure program. XSS vulnerability exists in HYBBS 1.5.34 CMS. An attacker can use this vulnerability to implant cross-site code, obtain sensitive information such as user cookies, close cross-site pop-up boxes, and also obtain page path...