DEBIAN-CVE-2017-14617

In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation. In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files. Remediation There is no fixed version for...

Asterisk RTP/RTCP Information Leak Vulnerability (AST-2017-008)

Asterisk is prone to an information leak in RTP/RTCP. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk"; if...

UBUNTU-CVE-2017-14519

In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls aka a Gfx.cc infinite loop...

Asterisk Multiple Vulnerabilities (Aug 2017)

Asterisk is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk"; if description...

poppler: Integer overflow in JBIG2Stream.cc

An integer overflow leading to heap-based buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler such as Evince to crash, or potentially execute arbitrary code when opened...

Debian DSA-3957-1 : ffmpeg - security update

Several vulnerabilities have been discovered in FFmpeg, a multimedia player, server and encoder. These issues could lead to Denial-of-Service and, in some situation, the execution of arbitrary code. - CVE-2017-9608 Yihan Lian of Qihoo 360 GearTeam discovered a NULL pointer access when parsing a...

libfpx Denial of Service Vulnerability (CNVD-2017-25764)

libfpx is a library for manipulating FlashPIX images. A denial of service vulnerability exists in OLEStream::WriteVTLPSTR in olestrm.cpp in libfpx, which can be exploited by a remote attacker to cause a denial of service null pointer dereference via a specially crafted fpx image...

Capturing, Analyzing and Responding to Cyber Attacks: cyberprobe

The Cyberprobe project is an open-source distributed architecture for real-time monitoring of networks against attack. The software consists of two components: a probe, which collects data packets and forwards it over a network in standard streaming protocols. a monitor, which receives the stream...

CVE-2017-11228

Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing JPEG 2000 JP2 code stream data. Successful exploitation could lead to...

camel-core: Validation component vulnerable to SSRF via remote DTDs and XXE

It was found that Apache Camel's validation component evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can use this feature to make Server-Side Request Forgery SSRF attacks by sending XML documents with remote DTDs URLs or XM...

Adobe Acrobat And Reader Memory Corruption (APSB17-24: CVE-2017-11226)

A memory corruption vulnerability exists in Adobe Acrobat And Reader. The vulnerability is due to an error in the image processing engine when processing JPEG 2000 JP2 code stream data. A remote attacker may exploit this vulnerability by using a crafted JP2 file that contains large values for til...

Adobe Acrobat and Reader Memory Corruption (APSB17-24: CVE-2017-11228)

A memory corruption vulnerability exists in Adobe Reader and Acrobat. The vulnerability is due to code stream specification components. A remote attacker might exploit this issue by creating an incomplete code stream which can cause memory corruption...

UBUNTU-CVE-2017-12603

OpenCV Open Source Computer Vision Library through 3.3 has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 2-opencv-heapoverflow-fseek test case...

OpenCV Buffer Overflow Vulnerability

OpenCV is an open source, cross-platform, lightweight computer vision library. A buffer overflow vulnerability exists in the 'cv::RLByteStream::getBytes' function in the modules/imgcodecs/src/bitstrm.cpp file in OpenCV 3.3 and earlier versions. An attacker can exploit this vulnerability to cause ...

python security and bug fix update

2.7.5-58.0.1 - Add Oracle Linux distribution in platform.py orabug 20812544 2.7.5-58 - Set stream to None in case an open fails. Resolves: rhbz1432003 2.7.5-57 - Fix implicit declaration warnings of functions added by patches 147 and 265 Resolves: rhbz1441237 2.7.5-56 - Fix shutil.makearchive...

OpenCV Denial of Service Vulnerability (CNVD-2017-24180)

OpenCV is an open source, cross-platform, lightweight computer vision library. A denial-of-service vulnerability exists in the 'cv::RBaseStream::readBlock' function in the modules/imgcodecs/src/bitstrm.cpp file in OpenCV 3.3 and earlier versions. An attacker can exploit this vulnerability to caus...

PT-2017-4339

Name of the Vulnerable Software and Affected Versions: OpenCV versions through 3.3 Description: The issue is related to an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file using cv::imread. This can lead to a buffer overflow,...

gstreamer-plugins-bad-free: Use after free in gst_mini_object_unref / gst_tag_list_unref / gst_mxf_demux_update_essence_tracks

Multiple use-after-free vulnerabilities in the 1 gstminiobjectunref, 2 gsttaglistunref, and 3 gstmxfdemuxupdateessencetracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service crash via vectors involving stream tags, as demonstrated by 02785736.mxf...

CVE-2017-11717

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page...