Mozilla Foundation Security Advisory 2012-06

Mozilla Foundation Security Advisory 2012-06 Title: Uninitialized memory appended when encoding icon images may cause information disclosure Impact: High Announced: January 31, 2012 Reporter: Tim Abraldes Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 10.0 Thunderbird 10.0 SeaMonkey...

CVE-2011-3458

QuickTime in Apple Mac OS X before 10.7.3 does not prevent access to uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted MP4 file...

PT-2012-1704

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.7.3 QuickTime versions prior to the version in 10.7.3 Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted MP4 file, due to the failure to preven...

CVE-2011-3458: Undefined Security Weakness

QuickTime in Apple Mac OS X before 10.7.3 does not prevent access to uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted MP4 file...

Critical: php

Issue Overview: It was discovered that the fix for CVE-2011-4885 introduced an uninitialized memory use flaw. A remote attacker could send a specially-crafted HTTP request to cause the PHP interpreter to crash or, possibly, execute arbitrary code. Affected Packages: php Issue Correction: Run yum...

FreeBSD : mozilla -- multiple vulnerabilities (0a9e2b72-4cb7-11e1-9146-14dae9ebcf89)

The Mozilla Project reports : MFSA 2012-01 Miscellaneous memory safety hazards rv:10.0/ rv:1.9.2.26 MFSA 2012-02 Overly permissive IPv6 literal syntax MFSA 2012-03 iframe element exposed across domains via name attribute MFSA 2012-04 Child nodes from nsDOMAttribute still accessible after removal ...

Firefox < 10.0 Multiple Vulnerabilities (Mac OS X)

The installed version of Firefox 9.x is potentially affected by the following security issues : - A use-after-free error exists related to removed nsDOMAttribute child nodes.CVE-2011-3659 - Various memory safety issues exist. CVE-2012-0442, CVE-2012-0443 - Memory corruption errors exist related t...

Uninitialized memory appended when encoding icon images may cause information disclosure — Mozilla

Mozilla developer Tim Abraldes reported that when encoding images as image/vnd.microsoft.icon the resulting data was always a fixed size, with uninitialized memory appended as padding beyond the size of the actual image. This is the result of mImageBufferSize in the encoder being initialized with...

Xpra memory disclosure

It's possible to access uninitialized memory chunks...

FreeBSD : OpenSSL -- multiple vulnerabilities (78cc8a46-3e56-11e1-89b4-001ec9578670)

The OpenSSL Team reports : 6 security flaws have been fixed in OpenSSL 1.0.0f : If X509VFLAGPOLICYCHECK is set in OpenSSL 0.9.8, then a policy check failure can lead to a double-free. OpenSSL prior to 1.0.0f and 0.9.8s failed to clear the bytes used as block cipher padding in SSL 3.0 records. As ...

CVE-2012-0005: Undefined Security Weakness

The Client/Server Run-time Subsystem aka CSRSS in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2, when a Chinese, Japanese, or Korean system locale is used, can access uninitialized memory during the processing of Unicode characters, which...

Adobe Reader U3D Memory Corruption

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' require 'zlib' class Metasploit3...

Asterisk uninitilized memory reference

Crash on SIP request processing...

CVE-2011-3231

The SSL implementation in Apple Safari before 5.1.1 on Mac OS X before 10.7 accesses uninitialized memory during the processing of X.509 certificates, which allows remote web servers to execute arbitrary code via a crafted certificate...

CVE-2011-3220

CVE-2011-3220 affects Apple QuickTime. The flaw is an uninitialized memory access in how QuickTime handles URL data handlers within movie files, allowing remote attackers to read memory contents via a crafted file. The issue is tied to QuickTime's atom data handling and can lead to memory disclos...

CVE-2011-3231

CVE-2011-3231 affects Apple Safari before 5.1.1 on Mac OS X before 10.7. The SSL implementation accesses uninitialized memory during X.509 certificate processing, enabling remote code execution via a crafted certificate. Public records include the NVD entry, vulnerability lists, and Apple’s advis...

PT-2011-4324

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 5.1.1 Description The issue concerns the SSL implementation in Apple Safari, which accesses uninitialized memory when processing X.509 certificates. This allows remote web servers to execute arbitrary code via a...

CVE-2011-3231: Improper Control of Generation of Code

The SSL implementation in Apple Safari before 5.1.1 on Mac OS X before 10.7 accesses uninitialized memory during the processing of X.509 certificates, which allows remote web servers to execute arbitrary code via a crafted certificate...

CentOS Update for libpng CESA-2011:1104 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for libpng CESA-2011:1104 centos5 i386

Check for the Version of libpng OpenVAS Vulnerability Test CentOS Update for libpng CESA-2011:1104 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it und...