January 3, 2018—KB4056892 (OS Build 16299.192)

None None...

Zhejiang Dahua Playback Library SDK (win32) suffers from an out-of-bounds access vulnerability

Hikvision playback library SDK programming is a Hikvision embedded network DVRs, video servers, equipment related to the playback of the supporting products of the secondary development kit. An out-of-bounds access vulnerability exists in dhplay.dll of the playback library SDK provided by Zhejian...

Vulnerability Spotlight: Arbitrary Code Execution Bugs in Simple DirectMedia Layer Fixed

Today, Talos is disclosing two vulnerabilities that have been identified in the Simple DirectMedia Layer library. Simple DirectMedia Layer SDL is a cross-platform development library designed for use in video playback software, emulators, and games by providing low level access to audio, keyboard...

September 19, 2017—KB4038803 (Preview of Monthly Rollup)

None None...

Command injection

Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure i.e., a podcast file that includes shell...

CVE-2017-14500

Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure i.e., a podcast file that includes shell...

CVE-2017-14500

Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure i.e., a podcast file that includes shell...

CVE-2017-14500

Removed by vendor...

CVE-2017-14500

Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure i.e., a podcast file that includes shell...

[ASA-201709-11] newsbeuter: arbitrary command execution

Arch Linux Security Advisory ASA-201709-11 ========================================== Severity: High Date : 2017-09-16 CVE-ID : CVE-2017-12904 CVE-2017-14500 Package : newsbeuter Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-401 Summary ======= The...

Denial of Service Vulnerability in Storm Video 5

Storm Video 5 is the video playback software of Beijing Storm Technology Co. Storm Video 5 decoder has a denial of service vulnerability when decoding special mp4 files, which can be exploited by attackers to cause the software to crash, resulting in a denial of service...

WildMIDI 0.4.2 - Multiple Vulnerabilities

WildMIDI 0.4.2 - Multiple Vulnerabilities wildmidi multiple vulnerabilities ================ Author : qflb.wu =============== Introduction: ============= WildMIDI is a simple software midi player which has a core softsynth library that can be use with other applications.The WildMIDI library uses...

Android ALSA PCM Playback Kernel Module Memory Misreference Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handset Alliance OHA, of which the ALSA PCM Playback Kernel Module is an audio playback kernel module. A security vulnerability exists in the 'msmpcmplaybackclose' function of the ALSA PCM Playback Kern...

Moxa MXview 2.8 Private Key Disclosure

Credits: John Page AKA HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-REMOTE-PRIVATE-KEY-DISCLOSURE.txt + ISR: APPARITIONSEC Vendor: ============ www.moxa.com Product: =========== MXview V2.8 Download:...

Vulnerabilities of iOS and Mac OS X operating systems, allowing attackers to trigger service interruptions or execute arbitrary code

The vulnerability of the CoreMedia Playback component in iOS and Mac OS X operating systems arises from an operation that occurs outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure memory corruption, application...

CVE-2016-7588

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "CoreMedia Playback" component. It allows remote attackers to execute arbitrary code or cause a denial of service memory...

CVE-2016-7588

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "CoreMedia Playback" component. It allows remote attackers to execute arbitrary code or cause a denial of service memory...

CVE-2016-7588

CVE-2016-7588 affects Apple CoreMedia Playback across iOS < 10.2, macOS < 10.12.2, and watchOS

About the security content of Apple TV 7.2.1 - Apple Support

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website. For information about...

Arbitrary Code Execution Vulnerability in CoreMedia Playback Component of Multiple Apple Products

Apple iOS, watchOS, macOS, and tvOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices; watchOS is a smartwatch operating system; CoreMedia Playback is one of the multimedia playback controller components. A security vulnerability exists in the CoreMedia...