Oracle Linux 7 : qemu-kvm (ELSA-2016-0083)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-0083 advisory. - Resolves: bz1298047 CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations rhel-7.2.z Tenable has extracted the preceding...

CVE-2015-8743

QEMU aka Quick Emulator built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged CAPSYSRAWIO user/process could use this flaw to leak or corrupt QEMU memory bytes...

PT-2016-3991

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description The issue is related to an OOB r/w access problem in QEMU when built with NE2000 device emulation support. It can occur during 'ioport' read/write operations. A privileged user or process could...

qemu -- denial of service vulnerability in Human Monitor Interface support

Prasad J Pandit, Red Hat Product Security Team, reports: Qemu emulator built with the Human Monitor InterfaceHMP support is vulnerable to an OOB write issue. It occurs while processing 'sendkey' command in hmpsendkey routine, if the command argument is longer than the 'keynamebuf' buffer size. A...

Avast! - Out-of-Bounds Write Decrypting PEncrypt Packed executables

Source: https://code.google.com/p/google-security-research/issues/detail?id=554 The attached PEncrypt packed executable causes an OOB write on Avast Server Edition. gdb bt 0 0xf6f5e64a in EmulatePolyCodePOLYINFO, int from /proc/self/cwd/defs/15092301/engine.so 1 0xf6f7d334 in...

Adobe Flash - Out-of-Bounds Read in UTF Conversion

Adobe Flash - Out-of-Bounds Read in UTF Conversion Source: https://code.google.com/p/google-security-research/issues/detail?id=378&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id We've hit the same bug from two different avenues: 1 A report to the Chromium bug tracker:...

Adobe Flash - Out-of-Bounds Read in UTF Conversion

Source: https://code.google.com/p/google-security-research/issues/detail?id=378&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id We've hit the same bug from two different avenues: 1 A report to the Chromium bug tracker:...

HP WebInspect 10.4 XML External Entity

Exploit Title: HP WebInspect - XML External Entity Date: 23\04\2015 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.hp.com/ Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x CVE : CVE-2015-2125 1. Create website that exploits vulnerability. 1.1. Website that steals files using OO...

HP WebInspect 10.4 - XML External Entity Injection

HP WebInspect 10.4 - XML External Entity Injection Exploit Title: HP WebInspect - XML External Entity Date: 23\04\2015 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.hp.com/ Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x CVE : CVE-2015-2125 1. Create website that exploits...

HP WebInspect 10.4 - XML External Entity Injection

Exploit Title: HP WebInspect - XML External Entity Date: 23\04\2015 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.hp.com/ Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x CVE : CVE-2015-2125 1. Create website that exploits vulnerability. 1.1. Website that steals files using OO...

Mandriva Linux Security Advisory : unzip (MDVSA-2015:123)

Updated unzip package fix security vulnerabilities : The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification CVE-2014-8139, the testcompreb CVE-2014-8140 and the getZip64Data CVE-2014-8141 functions. The input errors may result in in arbitrary code...

openSUSE Security Update : jasper (openSUSE-SU-2015:0200-1)

This update fixes the following security issues : - CVE-2014-8157, CVE-2014-8158: use after free and OOB vulnerabilities bnc911837 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

ICU: font parsing OOB read (OpenJDK 2D, 8056276)

A boundary check flaw was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory...

RHEL 6 / 7 : java-1.7.0-openjdk (RHSA-2015:0067)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0067 advisory. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. A flaw w...

Mandriva Linux Security Advisory : unzip (MDVSA-2015:016)

Updated unzip package fix security vulnerabilities : The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification CVE-2014-8139, the testcompreb CVE-2014-8140 and the getZip64Data CVE-2014-8141 functions. The input errors may result in in arbitrary code...

openSUSE Security Update : cpio (openSUSE-SU-2014:1643-1)

This cpio update fixes the following secuirty issue : - fix an OOB write with cpio -i bnc907456 CVE-2014-9112 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2014-771. The text...

Kernel: HID: logitech-dj OOB array access

An out-of-bounds read flaw was found in the way the Logitech Unifying receiver driver handled HID reports with an invalid deviceindex value. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system...

FreeBSD : chromium -- multiple vulnerabilities (963413a5-bf50-11e3-a2d6-00262d5ed8ee)

Google Chrome Releases reports : 31 vulnerabilities fixed in this release, including : - 354123 High CVE-2014-1716: UXSS in V8. Credit to Anonymous. - 353004 High CVE-2014-1717: OOB access in V8. Credit to Anonymous. - 348332 High CVE-2014-1718: Integer overflow in compositor. Credit to Aaron...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 31 vulnerabilities fixed in this release, including: 354123 High CVE-2014-1716: UXSS in V8. Credit to Anonymous. 353004 High CVE-2014-1717: OOB access in V8. Credit to Anonymous. 348332 High CVE-2014-1718: Integer overflow in compositor. Credit to Aaron Staple...

Stable Channel Update for Chrome OS

The Stable channel has been updated to 33.0.1750.152 Platform version: 5116.115.4/5116.115.5 for all devices. This build contains security fixes for Pwnium. Systems will be receiving the updates over the next few days. Security Fixes and Rewards Congratulations to geohot for an epic Pwnium...