Internet Bug Bounty: Stack Buffer Overflow in GD dynamicGetbuf

Stack-based buffer over flow in GD dynamicGetbuf - Vulnerable function: imagecreatefromstring - Bug has been reported: https://bugs.php.net/bug.php?id=73280 - Submitted a patch and accepted: https://github.com/php/php-src/commit/cc08cbc84d46933c1e9e0149633f1ed5d19e45e9 - Impact: Remotely...

Content-Spoofing in "files" app (NC-SA-2016-010)

The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user...

ffmpeg memory leak vulnerability

FFmpeg is a set of open source computer programs that can be used to record, convert digital audio and video to streams. Under the LGPL or GPL license. It provides a complete solution for recording, converting, and streaming audio and video. A memory leak vulnerability exists in avireadheader in...

ffmpeg Contingency Disposal Error Vulnerability

FFmpeg is a set of open source computer programs that can be used to record, convert digital audio and video to streams. Under the LGPL or GPL license. It provides a complete solution for recording, converting, and streaming audio and video. A security vulnerability in readgab2sub in ffmpeg3.1.4...

Bundler Code Execution Vulnerability

Bundler is a system developed in C and C++ called sfm structure-from-motion, which is capable of reconstructing 3D models from unordered collections of images e.g., from the Web. There is a security vulnerability in Bundler that allows an attacker to execute arbitrary code on an application by...

ffmpeg denial of service vulnerability (CNVD-2016-08733)

FFmpeg is a set of open source computer programs that can be used to record, convert digital audio and video to streams. Under the LGPL or GPL license. It provides a complete solution for recording, converting, and streaming audio and video. A denial of service vulnerability exists in avireadniko...

CVE-2016-6386

Cisco IOS XE 3.1 through 3.17 and 16.1 on 64-bit platforms allows remote attackers to cause a denial of service data-structure corruption and device reload via fragmented IPv4 packets, aka Bug ID CSCux66005...

CVE-2016-6386

Cisco IOS XE 3.1 through 3.17 and 16.1 on 64-bit platforms allows remote attackers to cause a denial of service data-structure corruption and device reload via fragmented IPv4 packets, aka Bug ID CSCux66005...

Memory corruption

Cisco IOS XE 3.1 through 3.17 and 16.1 on 64-bit platforms allows remote attackers to cause a denial of service data-structure corruption and device reload via fragmented IPv4 packets, aka Bug ID CSCux66005...

CVE-2016-6386

Cisco IOS XE 3.1 through 3.17 and 16.1 on 64-bit platforms allows remote attackers to cause a denial of service data-structure corruption and device reload via fragmented IPv4 packets, aka Bug ID CSCux66005...

xen-kernel -- use after free in FIFO event channel code

The Xen Project reports: When the EVTCHNOPinitcontrol operation is called with a bad guest frame number, it takes an error path which frees a control structure without also clearing the corresponding pointer. Certain subsequent operations EVTCHNOPexpandarray or another EVTCHNOPinitcontrol, upon...

Forensic File System Reconstruction: RecuperaBit

Forensic File System Reconstruction A software which attempts to reconstruct file system structures and recover files. Currently it supports only NTFS. RecuperaBit attempts reconstruction of the directory structure regardless of: missing partition table unknown partition boundaries...

Windows 8.1 kernel exploit—CVE-2 0 1 4-4 1 1 3 vulnerability analysis-vulnerability warning-the black bar safety net

! 1. Case description: 2 0 1 4 years 1 0 month 1 4 day, CrowdStrike and FireEye, two IT companies each publish a blog post, in which are invariably introduced a Windows-based system to the new kernel privilege elevation vulnerability. CrowdStrike, the company mentioned in the article: they are on...

Airbnb: ████ discloses valid Airbnb SSO login names via Google Search Results

Hello, There is an Information leakage type weakness present on ███████ which supposedly works as a Single Sign On SSO gateway for Airbnb's corporate services. The weakness is present due to lack of robots exclusions policy file robots.txt present on this domain which allows web crawlers such as...

Microsoft Word 20132016 - sprmSdyaTop Denial of Service (MS16-099)

Microsoft Word 20132016 - sprmSdyaTop Denial of Service MS16-099 Application: Microsoft Office Word Platforms: Windows, OSX Versions: Microsoft Office Word 2013,2016 Author: Francis Provencher of COSIG Website: https://cosig.gouv.qc.ca/en/advisory/ Twitter: @COSIG Date: August 09, 2016 CVE:...

PT-2016-3449 · Xmlsoft +9 · Libxml2 +9

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: The issue is related to a possible cross-site scripting vulnerability in libxml2. This vulnerability may allow a remote attacker to access and compromise confidential data. The vulnerabilit...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-3051-1)

It was discovered that the keyring implementation in the Linux kernel did not ensure a data structure was initialized before referencing it after an error condition occurred. A local attacker could use this to cause a denial of service system crash. CVE-2016-4470 Kangjie Lu discovered an...

Putting Apple Bug Bounty Rewards in Perspective

Admittedly, the payouts for Apple’s bug bounty announced last week at Black Hat drew mixed reactions ranging from reasonable to raucously funny. Apple made a big splash at the annual hacker conference, first via a last-minute announcement that well-regarded Ivan Krstic would be giving a talk on...

USN-3050-1: Linux kernel (OMAP4) vulnerabilities

Ben Hawkes discovered that the Linux netfilter implementation did not correctly perform validation when handling IPTSOSETREPLACE events. A local unprivileged attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privileges...

chromium-browser: Same origin bypass for images in Blink

Blink, as used in Google Chrome before 52.0.2743.116, does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code...