Security Bulletin: ASN. 1 coding in the presence of a heap memory corruption vulnerability-vulnerability warning-the black bar safety net

! ! 1. Security Bulletin information Title: Objective system integrated Co., Ltd. The design of the ASN. 1 coding specification in the presence of one can lead to heap memory corruption vulnerabilities. Vulnerability CVE number: CVE-2 0 1 6-5 0 8 0 Announcement of the URL address:...

UBUNTU-CVE-2016-4583

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document...

Wowza Streaming Engine 4.5.0 Cross Site Scripting

i? Wowza Streaming Engine 4.5.0 Multiple Cross-Site Scripting Vulnerabilities Vendor: Wowza Media Systems, LLC. Product web page: https://www.wowza.com Affected version: 4.5.0 build 18676 Platform: JSP Summary: Wowza Streaming Engine is robust, customizable, and scalable server software that powe...

The vulnerability of Google Chrome browser allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

The use of this feature after release in SVG implementation for Blink for Google Chrome allows malicious actors operating remotely to trigger service failures or otherwise affect the system by using incorrect caching related to animations...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the xfonts-scalable package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

The vulnerability of Thunderbird software, which allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

The use of this feature after release in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox, Firefox ESR, and Thunderbird allows malicious actors operating remotely to execute arbitrary code or cause service failures errors when working with dynamic memory through SVG animations th...

The vulnerability of the Thunderbird email client, which allows a malicious individual to gain access to confidential information

The Thunderbird email client contains a vulnerability related to errors in the implementation of the SVG filter. This vulnerability allows a malicious actor to gain access to confidential information about displacement and correlations, as well as to circumvent domain restriction policies. The...

[SECURITY] Fedora 24 Update: nodejs-4.4.6-2.fc24

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

Suricata 3.1 - Open Source IDS / IPS / NSM engine

Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation OISF. Suricata is developed by the OISF and its supporting vendors. Top 3 Reasons You Should Try Suricat...

DEBIAN-CVE-2016-2819

Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via foreign-context HTML5 fragments, as demonstrated by fragments within an SVG element...

GraphicsMagick magick/render.c File Denial of Service Vulnerability

GraphicsMagick is a simple set of image processing tools. A denial-of-service vulnerability exists in GraphicsMagick's handling of special svg files, which can be exploited by remote attackers to construct malicious files and trick applications into parsing them, which can crash the application...

Mozilla: Buffer overflow parsing HTML5 fragments (MFSA 2016-50)

Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via foreign-context HTML5 fragments, as demonstrated by fragments within an SVG element...

UBUNTU-CVE-2016-2819

Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via foreign-context HTML5 fragments, as demonstrated by fragments within an SVG element...

DEBIAN-CVE-2016-4348

The rsvgcssnormalizefontsize function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service stack consumption and application crash via circular definitions in an SVG document...

DEBIAN-CVE-2015-7557

The rsvgnodepolybuildpath function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service out-of-bounds heap read via an odd number of elements in a coordinate pair in an SVG document...

UBUNTU-CVE-2015-7557

The rsvgnodepolybuildpath function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service out-of-bounds heap read via an odd number of elements in a coordinate pair in an SVG document...

UBUNTU-CVE-2016-4348

The rsvgcssnormalizefontsize function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service stack consumption and application crash via circular definitions in an SVG document...

UBUNTU-CVE-2015-7558

librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service infinite loop, stack consumption, and application crash via cyclic references in an SVG document...

librsvg2 Out-of-Bounds Heap Read Vulnerability

librsvg2 is an SVG rendering engine written in C. It can be used to render a number of SVG files. A security vulnerability exists in librsvg2. An attacker can exploit this vulnerability to cause an out-of-bounds heap read with an SVG file...

RoundCube Webmail Cross-Site Scripting Vulnerability (CNVD-2016-02711)

RoundCube Webmail is a browser-based IMAP client mail client. A cross-site scripting vulnerability exists in RoundCube Webmail, which can be exploited to inject arbitrary web script or HTML with the help of specially crafted Svg image files...