Adobe Flash - Out-of-Bounds Read in UTF Conversion

Source: https://code.google.com/p/google-security-research/issues/detail?id=378&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id We've hit the same bug from two different avenues: 1 A report to the Chromium bug tracker:...

HP WebInspect 10.4 XML External Entity

Exploit Title: HP WebInspect - XML External Entity Date: 23\04\2015 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.hp.com/ Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x CVE : CVE-2015-2125 1. Create website that exploits vulnerability. 1.1. Website that steals files using OO...

HP WebInspect 10.4 - XML External Entity Injection

HP WebInspect 10.4 - XML External Entity Injection Exploit Title: HP WebInspect - XML External Entity Date: 23\04\2015 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.hp.com/ Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x CVE : CVE-2015-2125 1. Create website that exploits...

HP WebInspect 10.4 - XML External Entity Injection

Exploit Title: HP WebInspect - XML External Entity Date: 23\04\2015 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.hp.com/ Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x CVE : CVE-2015-2125 1. Create website that exploits vulnerability. 1.1. Website that steals files using OO...

Mandriva Linux Security Advisory : unzip (MDVSA-2015:123)

Updated unzip package fix security vulnerabilities : The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification CVE-2014-8139, the testcompreb CVE-2014-8140 and the getZip64Data CVE-2014-8141 functions. The input errors may result in in arbitrary code...

openSUSE Security Update : jasper (openSUSE-SU-2015:0200-1)

This update fixes the following security issues : - CVE-2014-8157, CVE-2014-8158: use after free and OOB vulnerabilities bnc911837 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

ICU: font parsing OOB read (OpenJDK 2D, 8056276)

A boundary check flaw was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory...

RHEL 6 / 7 : java-1.7.0-openjdk (RHSA-2015:0067)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0067 advisory. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. A flaw w...

Mandriva Linux Security Advisory : unzip (MDVSA-2015:016)

Updated unzip package fix security vulnerabilities : The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification CVE-2014-8139, the testcompreb CVE-2014-8140 and the getZip64Data CVE-2014-8141 functions. The input errors may result in in arbitrary code...

openSUSE Security Update : cpio (openSUSE-SU-2014:1643-1)

This cpio update fixes the following secuirty issue : - fix an OOB write with cpio -i bnc907456 CVE-2014-9112 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2014-771. The text...

Kernel: HID: logitech-dj OOB array access

An out-of-bounds read flaw was found in the way the Logitech Unifying receiver driver handled HID reports with an invalid deviceindex value. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system...

FreeBSD : chromium -- multiple vulnerabilities (963413a5-bf50-11e3-a2d6-00262d5ed8ee)

Google Chrome Releases reports : 31 vulnerabilities fixed in this release, including : - 354123 High CVE-2014-1716: UXSS in V8. Credit to Anonymous. - 353004 High CVE-2014-1717: OOB access in V8. Credit to Anonymous. - 348332 High CVE-2014-1718: Integer overflow in compositor. Credit to Aaron...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 31 vulnerabilities fixed in this release, including: 354123 High CVE-2014-1716: UXSS in V8. Credit to Anonymous. 353004 High CVE-2014-1717: OOB access in V8. Credit to Anonymous. 348332 High CVE-2014-1718: Integer overflow in compositor. Credit to Aaron Staple...

Stable Channel Update for Chrome OS

The Stable channel has been updated to 33.0.1750.152 Platform version: 5116.115.4/5116.115.5 for all devices. This build contains security fixes for Pwnium. Systems will be receiving the updates over the next few days. Security Fixes and Rewards Congratulations to geohot for an epic Pwnium...

Fedora 19 : libtiff-4.0.3-9.fc19 (2013-15679)

OOB Write in LZW decompressor Man page fixing Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

SuSE 11.3 Security Update : Mesa (SAT Patch Number 8011)

A memory corruption in the Mesa Intel drivers OOB read/write has been fixed. CVE-2013-1872 This could have been potentially exploited by remote attackers who would have been able to inject 3d graphics into the attacked desktop. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

RHEL 6 : mesa (RHSA-2013:0897)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0897 advisory. - Mesa: Memory corruption OOB read/write on intel drivers CVE-2013-1872 - Mesa: Multiple integer overflows leading to heap-based bufer...

SuSE 11.2 Security Update : freetype2 (SAT Patch Number 7232)

This update fixes : - OOB access in bdffreefont and bdfparseglyphs CVE-2012-5668 / CVE-2012-5669 As well as the following non-security bugs : - bdf Savannah bug 37905. - src/bdf/bdflib.c bdfparsestart: Reset propssize' to zero in case of allocation error; this value gets used in a loop in - bdf F...

SuSE 10 Security Update : freetype2 (ZYPP Patch Number 8433)

This update fixes : - OOB access in bdffreefont CVE-2012-5668 As well as non-security bugs : - bdf Savannah bug 37905. o src/bdf/bdflib.c bdfparsestart: Reset propssize' to zero in case of allocation error; this value gets used in a loop in %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 138208 High CVE-2012-2900: Crash in Skia text rendering. Credit to Atte Kettunen of OUSPG. 147499 Critical CVE-2012-5108: Race condition in audio device handling. Credit to Atte Kettunen of OUSPG. 148692 Medium CVE-2012-5109: OOB read in ICU regex. Credit to Arthur...