[SECURITY] Fedora 29 Update: ghostscript-9.26-1.fc29

This package provides useful conversion utilities based on Ghostscript soft ware, for converting PS, PDF and other document formats between each other. Ghostscript is a suite of software providing an interpreter for Adobe Syste ms' PostScript PS and Portable Document Format PDF page description...

[SECURITY] Fedora 28 Update: poppler-0.62.0-14.fc28

poppler is a PDF rendering library...

Skia - Incorrect Convexity Assumptions Leading to Buffer Overflows

Skia - Incorrect Convexity Assumptions Leading to Buffer Overflows I was looking into the root cause of https://bugs.chromium.org/p/chromium/issues/detail?id=850350. In that bug, due to precision errors, Skia generated a concave RRect, but declared it convex. Later, the RRect was transformed with...

Skia - Incorrect Convexity Assumptions Leading to Buffer Overflows

I was looking into the root cause of https://bugs.chromium.org/p/chromium/issues/detail?id=850350. In that bug, due to precision errors, Skia generated a concave RRect, but declared it convex. Later, the RRect was transformed with an affine transform and used as a clipping region for drawing...

The vulnerability of the `write_validate_array_item()` function in the SPICE rendering system’s “demarshal.py” file, related to insufficient input data validation, allows attackers to access confidential information or cause service failures.

The vulnerability of the writevalidatearrayitem function in the SPICE rendering system’s “demarshal.py” file is related to message processing errors that lead to buffer overflows. Exploiting this vulnerability allows an attacker to gain access to confidential information or cause service failures...

CVE-2018-16481

A XSS vulnerability was found in html-page =2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of sanitization of the paths before rendering...

CVE-2018-16480

A XSS vulnerability was found in module public 0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names before rendering...

CVE-2018-16481

A XSS vulnerability was found in html-page =2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of sanitization of the paths before rendering...

CVE-2019-7295

typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula...

Design/Logic Flaw

typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula...

CVE-2019-7296

typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formula...

CVE-2019-7296

typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formula...

CVE-2019-5769

Incorrect handling of invalid end character position when front rendering in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Vulnerability of the sub-component’s overview page/report rendering in the Oracle E-Business Intelligence component of the Oracle E-Business Suite. This component is used for automating business processes within enterprises. It allows attackers to gain access to modify, add, or delete data.

The vulnerability of the sub-component’s overview page/report rendering in Oracle E-Business Intelligence, a system for automating business processes within the Oracle E-Business Suite, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating...

[SECURITY] Fedora 29 Update: poppler-0.67.0-10.fc29

poppler is a PDF rendering library...

USN-3865-1: poppler vulnerabilities

It was discovered that poppler incorrectly handled certain PDF files. An attacker could possibly use this issue to cause a denial of service. CVE-2018-20481, CVE-2018-20650...

January 22, 2019 — KB4481031 Cumulative update for .NET Framework 3.5 and 4.7.2 for Windows 10, version 1809 and Windows Server 2019

None None...

[SECURITY] Fedora 29 Update: php-horde-Horde-Form-2.0.19-1.fc29

The HordeForm package provides form rendering, validation, and other functionality for the Horde Application Framework...

[SECURITY] Fedora 28 Update: php-horde-Horde-Form-2.0.19-1.fc28

The HordeForm package provides form rendering, validation, and other functionality for the Horde Application Framework...

Denial Of Service (Dos)

freetype is vulnerable to denial of service. This is due to an out-of-bounds read when the rendering engine processes certain Glyph Bitmap Distribution Format BDF fonts. An attacker is able to crash a user's application, or potentially execute arbitrary code, via a malicious font file that is...