PT-2018-18076 · Mojoportal · Mojoportal

Name of the Vulnerable Software and Affected Versions: mojoPortal versions prior to 2.6.0.0 Description: The issue arises from the software's failure to sanitize user-supplied input, leading to multiple persistent cross-site scripting vulnerabilities. Specifically, the Title and Subtitle fields o...

openSUSE Security Update : mpv (openSUSE-2018-173)

This update for mpv fixes the following issues : MPV was updated to version 0.27.2 Security issues fixed : - CVE-2018-6360: Additional fix for where mpv allowed remote attackers to execute arbitrary code via a crafted website, because it read HTML documents containing VIDEO elements, and accepts...

WordPress responsive-coming-soon-page plugin cross-site scripting vulnerability (CNVD-2018-01265)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . responsive-coming-soon-page plugin is used in one of the test system maintenance plugin . A cross-site scriptin...

Debian: Security Advisory (DLA-1243-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

VideoLan VLC Media Player ParseJSS Heap Buffer Overflow (CVE-2017-8311)

A heap-based buffer overflow exists in VLC Media Player. The vulnerability is due to improper handling of certain directives in JACOsub subtitle files. A remote attacker could exploit this vulnerability by enticing a victim user to open a maliciously crafted subtitle file...

Automattic: SSRF and local file disclosure in https://wordpress.com/media/videos/ via FFmpeg HLS processing

Summary FFmpeg is a video encoding software that appears to be used by wordpress.com for video processing for paid accounts. FFmpeg is known to process HLS playlists that may contain references to external files. I was able to fire this feature using GAB2 subtitle chunks inside an AVI file. After...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

On EternalRocks, WannaCry, and More

Mike Mimoso and Chris Brook recap the news of the week, including the EternalRocks worm, the latest on WannaCry, a subtitle hack, and a Twitter flaw. Download: ThreatpostNewsWrapMay262017.mp3 Music by Chris Gonsalves...

VideoLAN VLC Heap Buffer Overflow Vulnerability

VideoLAN VLC is a free and open source cross-platform multimedia player also a multimedia framework developed by the French organization VideoLAN. It supports playback of multiple media files, CD-ROMs, etc., multiple audio and video formats WMV, MP3, etc., etc. ParseJSS is one of the subtitle fil...

VideoLAN VLC Denial of Service Vulnerability (CNVD-2017-08120)

VideoLAN VLC is a free and open source cross-platform multimedia player also a multimedia framework developed by the French organization VideoLAN. It supports playback of multiple media files, CD-ROMs, etc., multiple audio and video formats WMV, MP3, etc., etc. ParseJSS is one of the subtitle fil...

VLC Media Player 2.x < 2.2.5.1 Multiple Vulnerabilities

Binary data 700122.prm...

The media player can lead to millions of systems suffer from subtitles attack-vulnerability warning-the black bar safety net

Experts pointed out that, as long as the attacker can make the target user in which a vulnerable media player to open a malicious subtitle file will be able to fully control the device. For automatically from the Internet to get the caption of the application, without any user interaction it can...

VLC Media Player Subtitle Remote Code Execution Vulnerability - Mac OS X

VLC media player is prone to a heap overflow vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

VLC Media Player Subtitle Remote Code Execution Vulnerability - Windows

VLC media player is prone to a heap overflow vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

UBUNTU-CVE-2017-8313

Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted subtitles file...

UBUNTU-CVE-2017-8310

Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process causing a denial of service via a crafted subtitles file...

Subtitle Hack Leaves 200 Million Vulnerable to Remote Code Execution

A proof of concept attack using malicious video subtitle files reveals how adversaries can execute remote code on PCs, Smart TVs and mobile devices using popular video players and services such as VLC Media Player, Kodi, Stremio and Popcorn Time. “This is a brand new attack vector. We haven’t see...

Beware! Subtitle Files Can Hack Your Computer While You're Enjoying Movies

Do you watch movies with subtitles? Just last night, I wanted to watch a French movie, so I searched for English subtitles and downloaded it to my computer. Though that film was excellent, this morning a new research from Checkpoint scared me. I was unaware that a little subtitle file could hand...

openSUSE Security Update : gstreamer-plugins-base (openSUSE-2017-512)

This update for gstreamer-plugins-base fixes the following security issues : - A crafted AVI file could have caused a floating point exception leading to DoS bsc1024076, CVE-2017-5837, bsc1024079, CVE-2017-5844 - A crafted AVI file could have caused a stack overflow leading to DoS bsc1024047,...

openSUSE Security Update : gstreamer-plugins-base (openSUSE-2017-301)

This update for gstreamer-plugins-base fixes the following security issues : - A crafted AVI file could have caused a floating point exception leading to DoS bsc1024076, CVE-2017-5837, bsc1024079, CVE-2017-5844 - A crafted AVI file could have caused a stack overflow leading to DoS bsc1024047,...