Microsoft Windows Kernel - Pool Buffer Overflow Drawing Caption Bar (MS15-061)

Source: https://code.google.com/p/google-security-research/issues/detail?id=321 The PoC triggers a crashes due to a pool buffer overflow while drawing the caption bar of window. The trigger depends on the current window layout and resolution. The PoC takes an offset on the command line to be able...

Microsoft Windows Kernel - Pool Buffer Overflow Drawing Caption Bar (MS15-061)

Microsoft Windows Kernel - Pool Buffer Overflow Drawing Caption Bar MS15-061 Source: https://code.google.com/p/google-security-research/issues/detail?id=321 The PoC triggers a crashes due to a pool buffer overflow while drawing the caption bar of window. The trigger depends on the current window...

KLA10672 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, gain privileges, spoof user interface, impact local files, execute arbitrary code or obtain sensitive information. Below...

Information disclosure via the High Resolution Time API — Mozilla

Security researchers Yossef Oren, Vasileios P. Kemerlis, Simha Sethumadhavan, Angelos D. Keromytis of Columbia University's Network Security Lab reported a method of using the High Resolution Time API for side channel attacks. This attack uses JavaScript loaded through a hostile web page to track...

Vulnerability management the flow of electrons-vulnerability warning-the black bar safety net

0x01 is written on the front This article is mainly to share and record some of their own growth, such as a poorly written local, but also hope to Treatise on. In the most early for vulnerability management in this thing, individuals feel more nausea. Especially all kinds of mail sent to sent to,...

CVE-2015-6287

Cisco Web Security Appliance (WSA) versions 8.0.6-078 and 8.0.6-115 are affected by CVE-2015-6287. A vulnerability in the DNS resolution function allows an unauthenticated, remote attacker to cause a partial DoS (service outage) by sending a flood of TCP proxy traffic that leads to DNS resolution...

Lockpickers 3D-Printed Master Key for TSA Luggage Locks and BluePrint Leaked Online

Here're a good news and bad news for you. The good news is that if you lose the keys for your TSA-compliant "Travel Sentry" luggage locks then you can just 3D print your very own TSA master keys. The bad news is that anyone can now 3D print their own master keys to open your bags. Yes, the securi...

Cisco Web Security Appliance DNS Resolution Vulnerability

A vulnerability in the DNS resolution function of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition due to DNS name resolution failing through the device. The vulnerability is due to the handling of DNS requests...

Cisco Web Security Appliance DNS Resolution Vulnerability

Cisco Web Security Appliance contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service condition. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

Amazon Linux: Security Advisory (ALAS-2013-270)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cisco NX-OS ARP Service Restart Vulnerability

Cisco NX-OS software is a data center-class operating system that embodies modular design, sustainability, and maintainability. Cisco NX-OS has a security vulnerability that allows an attacker to submit a special ARP message that restarts the target ARP service...

PowerDNS Authoritative Server Message Handling Target Service Crash Vulnerability

PowerDNS Authoritative Server is a high performance authoritative DNS name server. A security vulnerability in the PowerDNS Authoritative Server DNS resolution code allows remote attackers to exploit the vulnerability to send special DNS messages that can crash the target service...

Cisco NX-OS Malformed ARP Header Denial of Service Vulnerability

A vulnerability in Address Resolution Protocol ARP feature of the Cisco Nexus Operating System NX-OS could allow an unauthenticated, adjacent attacker to cause a partial denial of service DoS condition because the ARP process unexpectedly restarts. The vulnerability is due to improper input...

Threat Outbreak Alert RuleID17668: Email Messages Distributing Malicious Software on August 31, 2015

Medium Alert ID: 40743 First Published: 2015 August 31 21:07 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17668 may contain the following files: Name |...

Photos Leaked! Here's Top Features Expected in Next iPhone Release

Only 9 days are left for Apple's annual new iPhone launch event, where the company will bring its various new products but the obvious stars of the show will be the iPhone 6s and the iPhone 6s Plus. The company has not officially announced the iPhone 6S and iPhone 6S Plus yet, but a series of new...

Cisco Nexus Operating System Address Resolution Protocol Denial of Service Vulnerability

A vulnerability in the Address Resolution Protocol ARP input packet processing of the Cisco Nexus Operating System NX-OS devices could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. The vulnerability is due to improper validation of the ARP packet and the...

USN-2706-1: OpenJDK 6 vulnerabilities

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. CVE-2015-2590, CVE-2015-2628, CVE-2015-4731, CVE-2015-4732,...

Moderate: Red Hat Bug Fix Advisory: 389-ds-base bug fix update

Updated 389-ds-base packages that fix several bugs are now available for Red Hat Enterprise Linux 7. The 389 Directory Server is an LDAPv3 compliant server. The base packages include the LDAP server and command-line utilities for server administration. This update fixes the following bugs:...

OpenJDK: DnsClient fails to release request information after error (JNDI, 8075378)

It was discovered that the JNDI component in OpenJDK did not handle DNS resolution errors correctly. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and CPU time, and possibly block further DNS resolution...

Scientific Linux Security Update : ntp on 6.x i686/x86_64 (2015:1459)

The remote Scientific Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2015:1459-1 advisory. - The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field...