Vulnerability in OpenSSL - OOB write in BN_bn2dec()

The function BNbn2dec does not check the return value of BNdivword. This can cause an OOB write if an application uses this function with an overly large BIGNUM. This could be a problem if an overly large certificate or CRL is printed out from an untrusted source. TLS is not affected because reco...

Foxit Reader ConvertToPDF TIFF Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ConvertToPDF...

Fedora 23 : xen (2016-0049aa6e5d) (Bunker Buster)

x86: Privilege escalation in PV guests XSA-182, CVE-2016-6258 x86: Missing SMAP whitelisting in 32-bit exception / event delivery XSA-183, CVE-2016-6259 virtio: unbounded memory allocation issue XSA-184, CVE-2016-5403 Qemu: scsi: esp: OOB write access in espdodma CVE-2016-6351 Note that Tenable...

Uber: Blind OOB XXE At "http://ubermovement.com/"

Test Summary : - POST data was set to &dtgmlf6ent; An HTTP request was initiated for the domain http://122.180.248.81/ which indicates that this script is vulnerable to XXE injection. NOTE : As it was Blind XXE Test I was Successful in Ping Test for XXE. But unable to retrieve any sensitive...

Vulnerability in OpenSSL - OOB read in TS_OBJ_print_bio()

The function TSOBJprintbio misuses OBJobj2txt: the return value is the total length the OID text representation would use and not the amount of data written. This will result in OOB reads when large OIDs are presented...

Fedora 22 : 2:qemu (2016-ea3002b577)

CVE-2016-4002: net: buffer overflow in MIPSnet bz 1326083 - CVE-2016-4952 scsi: pvscsi: out-of-bounds access issue - CVE-2016-5106: scsi: megasas: out-of-bounds write bz 1339581 - CVE-2016-5105: scsi: megasas: stack information leakage bz 1339585 - CVE-2016-5107: scsi: megasas: out-of-bounds read...

Fedora 23 : 2:qemu (2016-07eca37ea0)

CVE-2016-4020: memory leak in kvmvapic.c bz 1326904 - CVE-2016-4439: scsi: esb: OOB write 1 bz 1337503 - CVE-2016-4441: scsi: esb: OOB write 2 bz 1337506 - Fix regression installing windows 7 with qxl/vga bz 1339267 Note that Tenable Network Security has extracted the preceding description block...

Fedora 23 : xen (2016-103752d2a9)

Qemu: scsi: esp: OOB r/w access while processing ESPFIFO CVE-2016-5338 1343323 Qemu: scsi: megasas: information leakage in megasasctrlgetinfo CVE-2016-5337 1343909 ---- fix for CVE-2016-2858 doesn't build with qemu-xen enabled Unsanitised guest input in libxl device handling code XSA-175,...

Fedora 24 : xen (2016-389be30b95)

fix for CVE-2016-2858 doesn't build with qemu-xen enabled Unsanitised guest input in libxl device handling code XSA-175, CVE-2016-4962 1342132 Unsanitised driver domain input in libxl device handling XSA-178, CVE-2016-4963 1342131 arm: Host crash caused by VMID exhaust XSA-181 1342530 Qemu:...

Fedora 22 : xen (2016-9c228cbf13)

Qemu: scsi: esp: OOB r/w access while processing ESPFIFO CVE-2016-5338 1343323 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

SUSE-SU-2016:1785-1 Security update for kvm

kvm was updated to fix 33 security issues. These security issues were fixed: - CVE-2016-4439: Avoid OOB access in 53C9X emulation bsc980711 - CVE-2016-4441: Avoid OOB access in 53C9X emulation bsc980723 - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape bsc97815...

CyberPower Systems PowerPanel 3.1.2 - XML External Entity Out-Of-Band Data Retrieval

CyberPower Systems PowerPanel 3.1.2 XXE Out-Of-Band Data Retrieval Vendor: CyberPower Systems, Inc. Product web page: https://www.cyberpowersystems.com Affected version: 3.1.2 37567 Business Edition Summary: The PowerPanel® Business Edition software from CyberPower provides IT professionals with...

Linux Kernel 4.4.0-21 (Ubuntu 16.04 x64) - Netfilter 'target_offset' Out-of-Bounds Privilege Escalation

/ Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40053.zip / --------------------------------------------------- decr.c --------------------------------------------------- / Ubuntu 16.04 local root exploit - netfilter targetoffset OOB...

Apple Mac OSX Kernel - Out-of-Bounds Read of Object Pointer Due to Insufficient Checks in Raw Cast to enum Type

Apple Mac OSX Kernel - Out-of-Bounds Read of Object Pointer Due to Insufficient Checks in Raw Cast to enum Type / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=774 The IOHIDFamily function IOHIDDevice::handleReportWithTime takes at attacker controlled unchecked IOHIDReportType...

Apple Mac OSX Kernel - Out-of-Bounds Read of Object Pointer Due to Insufficient Checks in Raw Cast to enum Type

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=774 The IOHIDFamily function IOHIDDevice::handleReportWithTime takes at attacker controlled unchecked IOHIDReportType enum, which was cast from an int in either IOHIDLibUserClient::setReport or getReport: ret =...

qemu: multiple issues

CVE-2015-8558 denial of service An infinite-loop issue was found in the QEMU emulator built with USB EHCI emulation support. The flaw occurred during communication between the host controller interfaceEHCI and a respective device driver. These two communicate using an isochronous transfer...

CVE-2016-4952

Quick EmulatorQemu built with the VMWARE PVSCSI paravirtual SCSI bus emulation support is vulnerable to an OOB r/w access issue. It could occur while processing SCSI commands 'PVSCSICMDSETUPRINGS' or 'PVSCSICMDSETUPMSGRING'. A privileged user inside guest could use this flaw to crash the Qemu...

CVE-2015-8665

tifgetimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service out-of-bounds read via the SamplesPerPixel tag in a TIFF image...

Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445)

Qemu: nvram: OOB r/w access in processing firmware configurations CVE-2016-1714 1296080 Qemu: i386: NULL pointer dereference in vapicwrite CVE-2016-1922 1292767 qemu: Stack-based buffer overflow in megasasctrlgetinfo CVE-2015-8613 1293305 qemu-kvm: Infinite loop and out-of-bounds transfer start i...

Debian: Security Advisory (DSA-3500-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...