Pixel Update Bulletin—December 2020Stay organized with collectionsSave and categorize content based on your preferences.

The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices Google devices. For Google devices, security patch levels of 2020-12-05 or later address all issues in this bulletin and all issues in the December 2020 Android...

Integer Overflow

ImageMagick is vulnerable to integer overflows. Rounding calculations performed on unconstrained pixel offsets could lead to integer overflows resulting in a system hang or other unexpected behaviors...

DEBIAN-CVE-2020-27771

In RestoreMSCWarning of /coders/pdf.c there are several areas where calls to GetPixelIndex could result in values outside the range of representable for the unsigned char type. The patch casts the return value of GetPixelIndex to ssizet type to avoid this bug. This undefined behavior could be...

CVE-2020-25676

A flaw was found ImageMagick. Multiple unconstrained pixel offset calculations produce undefined behavior in the form of out-of-range and integer overflows. These instances of undefined behavior could be triggered by an attacker who is able to supply a crafted input file. The highest threat from...

Pixel Update Bulletin—November 2020Stay organized with collectionsSave and categorize content based on your preferences.

The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices Google devices. For Google devices, security patch levels of 2020-11-05 or later address all issues in this bulletin and all issues in the November 2020 Android...

Google Android Pixel Neural Core component buffer overflow vulnerability (CNVD-2020-60494)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. Pixel Neural Core is one of the image processing components. A security vulnerability exists in the Pixel Neural Core component of Google Android. An attacker can exploit the...

Google Android Pixel Neural Core Component Buffer Overflow Vulnerability

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. Pixel Neural Core is one of the image processing components. A security vulnerability exists in the Pixel Neural Core component of Google Android. An attacker can exploit the...

Android Security Bulletin—November 2020Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2020-11-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

Google Android Resource Management Error Vulnerability (CNVD-2020-59732)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. Android Pixel suffers from a security vulnerability that stems from a memory error caused by the Catpipe library. An attacker can exploit the vulnerability to perform privilege escalation locally...

NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2020-0041)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size...

Google Rolls Out Fixes for High-Severity Android System Flaws

Google has released patches addressing high-severity flaws in its System component. The flaws could be remotely exploited to gain access to additional permissions. Overall, 50 flaws were patched as part of Google’s October security update for the Android operating system, released on Monday. As...

Pixel Update Bulletin—October 2020Stay organized with collectionsSave and categorize content based on your preferences.

The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices Google devices. For Google devices, security patch levels of 2020-10-05 or later address all issues in this bulletin and all issues in the October 2020 Android...

Android Security Bulletin—October 2020Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2020-10-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

NVIDIA D3D10 driver nvwgf2umx_cfg.dll nvwg MOV code execution vulnerability

Summary An exploitable code execution vulnerability exists in the nvwg MOV functionality of the NVIDIA D3D10 driver, version 442.50 - 26.21.14.4250. A specially crafted shader can cause remote code execution. An attacker can use this vulnerability to guest-to-host escape through Hyper-V RemoteFX...

NVIDIA D3D10 Driver nvwgf2umx_cfg.dll nvwg DCL_CONSTANT_BUFFER code execution vulnerability

Summary An exploitable code execution vulnerability exists in the nvwg DCLCONSTANTBUFFER functionality of NVIDIA D3D10 Driver Version 442.50 - 26.21.14.4250. A specially crafted shader can cause remote code execution. An attacker can use this vulnerability to guest-to-host escape through Hyper-V...

NVIDIA D3D10 driver nvwgf2umx_cfg.dll nvwg MOV_SAT code execution vulnerability

Summary An exploitable code execution vulnerability exists in the nvwg MOVSAT functionality of the NVIDIA D3D10 driver, version 442.50 - 26.21.14.4250. A specially crafted shader can cause remote code execution. An attacker can use this vulnerability to guest-to-host escape through Hyper-V...

Arbitrary Code Execution

GIMP is vulnerable to arbitrary code execution. A heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c allows an attacker to execute arbitrary code via a malicious bits-per-pixel value for an RGBA image...

Arbitrary Code Execution

graphicsmagick is vulnerable to arbitrary code execution. The vulnerability exists as through a heap-based buffer overflow in the AcquireCacheNexus function in magick/pixelcache.c...

Arbitrary Code Execution

GraphicsMagick is vulnerable to arbitrary code execution. A memory leak in the PersistCache function in magick/pixelcache.c during writing of Magick Persistent Cache MPC files allows an attacker to execute arbitrary code on the host OS...

TikTok: Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platform

Due to an Insecure Direct Object Reference IDOR vulnerability, an attacker could have potentially added, deleted, or updated rules for other users' pixel events in the TikTok ads portal. We thank @bubbounty for reporting this to our team and confirming the resolution. This report is one of my...