Google Chrome Blink Information Disclosure Vulnerability (CNVD-2016-00723)

Google Chrome is a web browser. Google V8 is one of the open source JavaScript engines. Google Chrome uses Blink's WebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp file in the ' UnacceleratedImageBufferSurface' class in the...

kernel: crypto api unprivileged arbitrary module load via request_module()

A flaw was found in the way the Linux kernel's Crypto subsystem handled automatic loading of kernel modules. A local user could use this flaw to load any installed kernel module, and thus increase the attack surface of the running kernel...

kernel: crypto api unprivileged arbitrary module load via request_module()

A flaw was found in the way the Linux kernel's Crypto subsystem handled automatic loading of kernel modules. A local user could use this flaw to load any installed kernel module, and thus increase the attack surface of the running kernel...

UBUNTU-CVE-2016-1614

The UnacceleratedImageBufferSurface class in WebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp in Blink, as used in Google Chrome before 48.0.2564.82, mishandles the initialization mode, which allows remote attackers to obtain sensitive information from process memory via a...

Mozilla: Integer overflow allocating extremely large textures (MFSA 2015-139)

Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering a graphics operation that requires a large texture allocation...

Xcode 7 Bitcode workflow and Security Assessment-vulnerability warning-the black bar safety net

With Xcode 7, Apple is Xcode adds a new feature Bitcode 【1】： ! New features often mean new attack surface. This article first describes what is Bitcode and Bitcode workflow in the familiar with the Bitcode of the workflow, the next step is to assess the Bitcode related to the attack surface, and...

Mozilla: Integer overflow allocating extremely large textures (MFSA 2015-139)

Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering a graphics operation that requires a large texture allocation...

UBUNTU-CVE-2015-7212

Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering a graphics operation that requires a large texture allocation...

kernel: crypto api unprivileged arbitrary module load via request_module()

A flaw was found in the way the Linux kernel's Crypto subsystem handled automatic loading of kernel modules. A local user could use this flaw to load any installed kernel module, and thus increase the attack surface of the running kernel...

Windows Sandbox Attack Surface Analysis

Posted by James Forshaw, Quartermaster of Tools Analysing the attack surface of user-mode sandboxed applications is a good way to hunt for elevation of privilege vulnerabilities. Much of the task of enumerating the attack surface could be done manually, but that’s a very tedious and error prone...

DEBIAN-CVE-2015-5225

Buffer overflow in the vncrefreshserversurface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service heap memory corruption and process crash or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the serve...

CVE-2015-5225

Buffer overflow in the vncrefreshserversurface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service heap memory corruption and process crash or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the serve...

Python 2.7 array.fromstring Use After Free Vulnerability

Python 2.7 array.fromstring method suffers from a use after free caused by unsafe realloc use. The issue is triggered when an array is concatenated to itself via fromstring call. Title: Python 2.7 array.fromstring Use After Free Credit: John Leitch email protected Url1:...

System Hardening Guide

The purpose of system hardening is to eliminate as many security risks as possible. Hardening is the process of securing a system by reducing its attack surface. A system has a larger vulnerability surface the more functions it fulfills; in principle a single-function system is more secure than a...

spice: multiple issues

CVE-2015-3247 race condition flaw: A race condition flaw was found in spice's workerupdatemonitorsconfig function, leading to a heap-based memory corruption. A user in a guest could leverage this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of...

Scientific Linux Security Update : spice-server on SL6.x x86_64 (20151012)

A heap-based buffer overflow flaw was found in the way SPICE handled certain guest QXL commands related to surface creation. A user in a guest could use this flaw to read and write arbitrary memory locations on the host. CVE-2015-5261 A heap-based buffer overflow flaw was found in the way spice...

spice: host memory access from guest using crafted images

A heap-based buffer overflow flaw was found in the way SPICE handled certain guest QXL commands related to surface creation. A user in a guest could use this flaw to read and write arbitrary memory locations on the host...

spice: insufficient validation of surface_id parameter can cause crash

A heap-based buffer overflow flaw was found in the way spice handled certain QXL commands related to the "surfaceid" parameter. A user in a guest could use this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of the host QEMU-KVM process...

spice: host memory access from guest using crafted images

A heap-based buffer overflow flaw was found in the way SPICE handled certain guest QXL commands related to surface creation. A user in a guest could use this flaw to read and write arbitrary memory locations on the host...

Spice 'surface_id' Heap Overflow Vulnerability

SPICE Simple Protocol for Independent Computing Environments is one of the three main technology components of Red Hat Enterprise Virtualized Desktop Edition, an adaptive remote submission protocol that delivers the exact same end-user experience as a physical desktop. A security vulnerability...