CVE-2019-19818

The CVE-2019-19818 entry concerns Nitro Free PDF Reader 12.0.0.112, specifically the JBIG2Decode library in npdf.dll. The vulnerability is an Out-of-Bounds Read in CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0xa08a triggered by crafted Unicode content. Affected component: JBIG2Decode in np...

PT-2019-4872

Name of the Vulnerable Software and Affected Versions Django versions prior to 1.11.27 Django versions 2.x prior to 2.2.9 Django versions 3.x prior to 3.0.1 Description The issue allows account takeover by sending a password reset token to an attacker for a matched user account. This occurs when ...

Windows Defender Antivirus 4.18.1908.7-0 File Extension Spoofing Vulnerability

David Haintz ======================================================================= title: File Extension Spoofing product: Windows Defender Antivirus vulnerable version: 4.18.1908.7-0 fixed version: Virus Definition Update of 2019/09/30 CVE number: - impact: High homepage:...

CVE-2018-6797

A heap buffer write overflow, with control over the bytes written, was found in the way regular expressions employing Unicode rules are compiled. An attacker, with the ability to provide a specially crafted regular expression, could crash the perl interpreter, or possibly execute arbitrary code...

Windows Defender Antivirus 4.18.1908.7-0 File Extension Spoofing

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: File Extension Spoofing product: Windows Defender Antivirus vulnerable version: 4.18.1908.7-0 fixed version: Virus Definition Update of 2019/09/30 CVE number: - impact:...

CVE-2019-2232

In handleRun of TextLine.java, there is a possible application crash due to improper input validation. This could lead to remote denial of service when processing Unicode with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2019-2232

In handleRun of TextLine.java, there is a possible application crash due to improper input validation. This could lead to remote denial of service when processing Unicode with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Input validation

In handleRun of TextLine.java, there is a possible application crash due to improper input validation. This could lead to remote denial of service when processing Unicode with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2019-2232

In handleRun of TextLine.java, there is a possible application crash due to improper input validation. This could lead to remote denial of service when processing Unicode with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

SharpHide - Tool To Create Hidden Registry Keys

Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden null terminated registry key. This works by adding a null byte in front of the UNICODESTRING key valuename. More info about this technique can be found in the following whitepaper:...

Denial Of Service (DoS)

github.com/tdewolff/parse is vulnerable to denial of service. An infinite loop on unicode code points during re-parsing after parse error results in a denial of service condition...

Fedora 30 : mingw-libidn2 (2019-20e9736c97)

Libidn 2.3.0 released 2019-11-14 ================================== - Mitre has assigned CVE-2019-12290 which was fixed by the roundtrip feature introduced in 2.2.0 commit 241e8f48 - Update the data tables from Unicode 6.3.0 to Unicode 11.0 - Turn idn2punycodeencode, idn2punycodedecode into compa...

Fedora 29 : mingw-libidn2 (2019-28d3cd20c0)

Libidn 2.3.0 released 2019-11-14 ================================== - Mitre has assigned CVE-2019-12290 which was fixed by the roundtrip feature introduced in 2.2.0 commit 241e8f48 - Update the data tables from Unicode 6.3.0 to Unicode 11.0 - Turn idn2punycodeencode, idn2punycodedecode into compa...

Fedora 31 : mingw-libidn2 (2019-1ebb5c928e)

Libidn 2.3.0 released 2019-11-14 ================================== - Mitre has assigned CVE-2019-12290 which was fixed by the roundtrip feature introduced in 2.2.0 commit 241e8f48 - Update the data tables from Unicode 6.3.0 to Unicode 11.0 - Turn idn2punycodeencode, idn2punycodedecode into compa...

Fedora 31 : libidn2 (2019-f454c7a118)

Libidn 2.3.0 released 2019-11-14 ================================== - Mitre has assigned CVE-2019-12290 which was fixed by the roundtrip feature introduced in 2.2.0 commit 241e8f48 - Update the data tables from Unicode 6.3.0 to Unicode 11.0 - Turn idn2punycodeencode, idn2punycodedecode into compa...

libidn2 -- roundtrip check vulnerability

CVE list: GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except fo...

Debian DSA-4561-1 : fribidi - security update

Alex Murray discovered a stack-based buffer overflow vulnerability in fribidi, an implementation of the Unicode Bidirectional Algorithm algorithm, which could result in denial of service or potentially the execution of arbitrary code, when processing a large number of unicode isolate directional...

USN-4179-1: FriBidi vulnerability

Alex Murray discovered a stack-based buffer overflow when handling a large number of unicode isolate directives. An attacker could use this to cause a denial of service or possibly execute arbitrary code...

PT-2019-12758 · Phpoffice · Phpoffice Phpspreadsheet

Name of the Vulnerable Software and Affected Versions: PHPOffice PhpSpreadsheet versions prior to 1.8.0 Description: The issue arises from the XmlScanner decoding sheet1.xml from an .xlsx file to utf-8 if a different encoding is declared in the header. This was initially intended as a security...

MS10-063: Vulnerability in Unicode Scripts Processor could lead to remote code execution

Resolves a vulnerability in the Unicode Scripts Processor that could allow remote code execution if a user viewed a specially crafted document or web page with an application that supports embedded OpenType fonts.Support for Windows Vista Service Pack 1 SP1 ends on July 12, 2011. To continue...