CVE-2016-7856

Adobe DNG Converter versions 9.7 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution...

MGASA-2016-0415 Updated kernel packages fixes security vulnerabilities

This update is based on upstream 4.4.36 and fixes at least the following security issues: The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service system crash via a crafted application that makes sendto system calls, related...

php: OOB read in grapheme_stripos and grapheme_strpos when negative offset is used

The graphemestrpos function in ext/intl/grapheme/graphemestring.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service out-of-bounds read or possibly have unspecified other impact via a negative offset...

php: OOB read in grapheme_stripos and grapheme_strpos when negative offset is used

The graphemestripos function in ext/intl/grapheme/graphemestring.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service out-of-bounds read or possibly have unspecified other impact via a negative offset...

php: bcpowmod accepts negative scale causing heap buffer overflow corrupting _one_ definition

The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call...

php: bcpowmod accepts negative scale causing heap buffer overflow corrupting _one_ definition

The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the zero, one, or two global variable, which allows remote attackers to cause a denial of service or possibl...

Internet Bug Bounty: malloc negative size parameter

https://bugs.php.net/bug.php?id=73445 Thank you for your consideration...

libchewing: Negative-size-param in _Inner_InternalSpecialSymbol

Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6578305067122688 Fuzzer: libFuzzerlibchewingchewingdynamicconfigfuzzer Job Type: libfuzzerasanlibchewing Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State: InnerInternalSpecialSymbol...

libchewing: Negative-size-param in _Inner_InternalSpecialSymbol

Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5836280051007488 Fuzzer: libFuzzerlibchewingchewingdynamicconfigfuzzer Job Type: libfuzzerasanlibchewing Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State: InnerInternalSpecialSymbol EasySymbolInput...

libchewing: Negative-size-param in ChewingKillChar

Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6311985729765376 Fuzzer: libFuzzerlibchewingchewingdynamicconfigfuzzer Job Type: libfuzzerasanlibchewing Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State: ChewingKillChar KillFromLeft...

Microsoft Windows Kernel - Registry Hive Loading Negative RtlMoveMemory Size in nt!CmpCheckValueList (MS16-124)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=873 We have encountered Windows kernel crashes in the memmove function called by nt!CmpCheckValueList while loading corrupted registry hive files. An example of a crash log excerpt generated after triggering the bug is shown below:...

Logic design flaw vulnerability at DBSHOP_0.9.3_Beta /module/Shopfront/src/Shopfront/Controller/CartController.php

DBShop is an open source e-commerce online store system developed using endFramework. DBSHOP0.9.3Beta /module/Shopfront/src/Shopfront/Controller/CartController.php at the logical design flaws vulnerability. When adding an order, it fails to determine the quantity of the product and directly...

Logic design flaw vulnerability at DBSHOP_0.9.3_Beta /module/Shopfront/src/Shopfront/Controller/HomemoneyController.php

DBShop is an open source e-commerce online store system developed using endFramework. DBSHOP0.9.3Beta /module/Shopfront/src/Shopfront/Controller/HomemoneyController.php at the logical design flaws vulnerabilities. The vulnerability is caused due to the fact that when withdrawing money, the system...

CVE-2016-6696

sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via a large negative value for the data length, aka Qualcomm internal bug CR 1041130...

Fedora 23 : curl (2016-80f4f71eff)

reject negative string lengths in curleasyunescape CVE-2016-7167 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

PT-2016-3192 · Zlib +5 · Zlib +5

Name of the Vulnerable Software and Affected Versions: zlib versions 1.2.8 Description: The issue is related to an error in handling negative numbers in the inflateMark function of the zlib library. This could allow a remote attacker to cause unspecified impact, potentially leading to disruption ...

Adding CIA to DNA

Threatpost Op-Ed is a regular feature where experts contribute essays and commentary on what’s happening in security and privacy. Today’s contributor is Alexandrea Mellen. White and black hat hackers specialize in altering, accessing and sometimes destroying information. Genetic engineers take th...

Pillow -- multiple vulnerabilities

Pillow reports: Pillow prior to 3.3.2 may experience integer overflow errors in map.c when reading specially crafted image files. This may lead to memory disclosure or corruption. Pillow prior to 3.3.2 and PIL 1.1.7 at least do not check for negative image sizes in ImagingNew in Storage.c. A...

DEBIAN-CVE-2016-5636

Integer overflow in the getdata function in zipimport.c in CPython aka Python before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow...

SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2016:2053-1)

This update for libvirt fixes one security issue : - CVE-2016-5008: Empty VNC password disables authentication. bsc987527 Additionally, the update includes the following non-security fixes : - Improve waiting for block job readines in virsh. bsc989755 - Parse negative values in augeas lenses...