CVE-2017-14685

Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016aa61" on Windows. This occurs because xpsloadlinksinglyphs in...

SUSE-SU-2017:2499-1 Security update for Linux Kernel Live Patch 22 for SLE 12

This update for the Linux Kernel 3.12.61-5277 fixes several issues. The following security bugs were fixed: - CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access bsc1052368...

SUSE-SU-2017:2457-1 Security update for Linux Kernel Live Patch 5 for SLE 12 SP2

This update for the Linux Kernel 4.4.49-9211 fixes several issues. The following security bugs were fixed: - CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access bsc1052368...

delight.im: Add movie or series CSRF

Hello, I Found Cross-Site Request Forgery CSRF while adding new movie or series . Reproduction: - Login by any user. - Add Name,YEAR and STRING for the movie in poc...

youngleak.com XSS vulnerability

Open Bug Bounty ID: OBB-290551 Description| Value ---|--- Affected Website:| youngleak.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Nextcloud: Nextcloud logs ldap passwords

When the ldap server is temporarily unavailable, data like the attached ends up in log files. I've replaced usernames with XXXUSERnXXX and passwords with XXXPASSnXXX. It seems that at least the following are missing from $methodsWithSensitiveParameters in lib/private/Log.php: - bind -...

CVE-2017-3735

While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g...

sunstar.com.ph XSS vulnerability

Open Bug Bounty ID: OBB-281993 Description| Value ---|--- Affected Website:| sunstar.com.ph Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Microsoft Edge Chakra Incorrect Jit Optimization

Microsoft Edge: Chakra: incorrect jit optimization with TypedArray setter 3 CVE-2017-8601 Coincidentally, Microsoft released the patch for the issue 1290 the day after I reported it. But it seems they fixed it incorrectly again. This time, "funca, b, i;" is replaced with "funca, b, ;". PoC: 'use...

Microsoft Edge Charka Failed Re-Parse Exploit

InterpreterStackFrame::ProcessLinkFailedAsmJsModule in Microsoft Edge Chakra incorrectly re-parses. Microsoft Edge: Chakra: InterpreterStackFrame::ProcessLinkFailedAsmJsModule incorrectly re-parses CVE-2017-8645 When Chakra fails to link an asmjs module, it tries to re-parse the failed-to-link...

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch(CVE-2017-1000112)

Bug details When building a UFO packet with MSGMORE ipappenddata calls ipufoappenddata to append. However in between two send calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb-len...

Internet Bug Bounty: heap-buffer-overflow (WRITE of size 8) in Perl_pp_reverse()

Reported to the Perl security mailing list on 11 June 2017. Fixed pushed to git on 13 June 2017. No advisory. ==376==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000009a80 at pc 0xd1b9c4 bp 0x7ffd21892230 sp 0x7ffd21892228 WRITE of size 8 at 0x619000009a80 thread T0 0 0xd1b9c3 in...

Moderate: Red Hat Security Advisory: curl security, bug fix, and enhancement update

An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

CVE-2017-11755

The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service memory leak via a crafted file that is mishandled in an AcquireSemaphoreInfo call...

MGASA-2017-0227 Updated gdk-pixbuf2.0 packages fix security vulnerability

The gdk-pixbuf2.0 package has been updated to version 2.36.7, which fixes integer overflows in the ico, bmp, and tiff decoder, as well as fixing other bugs...

Coinbase: Device confirmation Flaw

Devices being auto-confirmed in an unexpected way looked like a security bug but was intended functionality...

WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy(CVE-2017-7064)

WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy Here's a snippet of JSArray::appendMemcpy. bool JSArray::appendMemcpyExecState exec, VM& vm, unsigned startIndex, JSC::JSArray otherArray auto scope = DECLARETHROWSCOPEvm; if !canFastCopyvm, otherArray return false; IndexingType type =...

Automattic: XSS Vulnerability in WooCommerce Product Vendors plugin

Version 2.0.27 of the WooCommerce Product Vendors plugin doesn't appear to correctly escape the "vendor description" POST parameter and can be manipulated to reflect arbitrary scripting. The good news is that it does appear to do some form of clientside validation before posting, in addition to...

WebKit JSC arrayProtoFuncSplice Uninitiailzed Memory Reference

WebKit: JSC: uninitialized memory reference in arrayProtoFuncSplice Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result = JSArray::tryCreateForInitializationPrivatevm,...

SUSE-SU-2017:1939-1 Security update for Linux Kernel Live Patch 21 for SLE 12

This update for the Linux Kernel 3.12.61-5272 fixes one issue. The following security bugs were fixed: - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be 'jumped' over the stack guard pa...