CVE-2017-8924

The edgebulkincallback function in drivers/usb/serial/ioti.c in the Linux kernel allows local users to obtain sensitive information in the dmesg ringbuffer and syslog from uninitialized kernel memory by using a crafted USB device posing as an ioti USB serial device to trigger an integer underflow...

Linux kernel information disclosure vulnerability (CNVD-2017-06927)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. An information disclosure vulnerability exists in the 'edgebulkincallback' function in the drivers/usb/serial/ioti.c file in Linux kernel versions 4.10.4 and earlier. A local...

Uninitialized Value Vulnerability in Multiple Mozilla Products

Mozilla Firefox, Firefox ESR and Thunderbird are all developed by the Mozilla Foundation.Firefox is an open source web browser, Firefox ESR is an extended support version of Firefox.Thunderbird is a standalone email client from the Mozilla Thunderbird is a separate email client from Mozilla...

Ubuntu 14.04 LTS / 16.04 LTS : Thunderbird vulnerabilities (USN-3278-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3278-1 advisory. Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could...

Microsoft Windows 7 Kernel - Uninitialized Memory in the Default dacl Descriptor of System Processes

Exploit for windows platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1145 We have observed on Windows 7 32-bit that for unclear reasons, the kernel-mode structure containing the default DACL of system processes' tokens lsass.exe, services.exe,...

Microsoft Windows 7 Kernel - Uninitialized Memory in the Default dacl Descriptor of System Processes Token

Microsoft Windows 7 Kernel - Uninitialized Memory in the Default dacl Descriptor of System Processes Token / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1145 We have observed on Windows 7 32-bit that for unclear reasons, the kernel-mode structure containing the default DACL ...

Microsoft Windows 7 Kernel - Uninitialized Memory in the Default dacl Descriptor of System Processes Token

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1145 We have observed on Windows 7 32-bit that for unclear reasons, the kernel-mode structure containing the default DACL of system processes' tokens lsass.exe, services.exe, ... has 8 uninitialized bytes at the end, as the size ...

CVE-2017-8924

The edgebulkincallback function in drivers/usb/serial/ioti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information in the dmesg ringbuffer and syslog from uninitialized kernel memory by using a crafted USB device posing as an ioti USB serial device to trigger an...

DEBIAN-CVE-2017-8924

The edgebulkincallback function in drivers/usb/serial/ioti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information in the dmesg ringbuffer and syslog from uninitialized kernel memory by using a crafted USB device posing as an ioti USB serial device to trigger an...

Microsoft Windows Kernel Local Information Disclosure Vulnerability (CNVD-2017-06617)

Microsoft Windows is the popular computer operating system. In some versions of Windows, the Windows kernel does not properly initialize memory objects, and a local information disclosure vulnerability exists in the implementation, allowing an attacker to obtain user system information...

UBUNTU-CVE-2017-8924

The edgebulkincallback function in drivers/usb/serial/ioti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information in the dmesg ringbuffer and syslog from uninitialized kernel memory by using a crafted USB device posing as an ioti USB serial device to trigger an...

EulerOS 2.0 SP1 : compat-libtiff3 (EulerOS-SA-2017-1044)

According to the versions of the compat-libtiff3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The 1 putcontig8bitYCbCr21tile function in tifgetimage.c or 2 NeXTDecode function in tifnext.c in LibTIFF allows remote attackers to cau...

[ASA-201704-10] libtiff: multiple issues

Arch Linux Security Advisory ASA-201704-10 ========================================== Severity: Medium Date : 2017-04-28 CVE-ID : CVE-2017-7592 CVE-2017-7593 CVE-2017-7594 CVE-2017-7595 CVE-2017-7596 CVE-2017-7597 CVE-2017-7598 CVE-2017-7599 CVE-2017-7600 CVE-2017-7601 CVE-2017-7602 Package :...

Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3260-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3260-1 advisory. Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could...

CVE-2017-7979

The cookie feature in the packet action API implementation in net/sched/actapi.c in the Linux kernel 4.11.x through 4.11-rc7 mishandles the tb nlattr array, which allows local users to cause a denial of service uninitialized memory access and refcount underflow, and system hang or crash or possib...

UBUNTU-CVE-2017-5445

A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and...

CVE-2017-5445

A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and...

CVE-2017-7979

The cookie feature in the packet action API implementation in net/sched/actapi.c in the Linux kernel 4.11.x through 4.11-rc7 mishandles the tb nlattr array, which allows local users to cause a denial of service uninitialized memory access and refcount underflow, and system hang or crash or possib...

Design/Logic Flaw

The cookie feature in the packet action API implementation in net/sched/actapi.c in the Linux kernel 4.11.x through 4.11-rc7 mishandles the tb nlattr array, which allows local users to cause a denial of service uninitialized memory access and refcount underflow, and system hang or crash or possib...

Windows Kernel stack memory disclosure in win32kfull!SfnINLPUAHDRAWMENUITEM (CVE-2017-0167)

We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 10 indirectly through the win32k! NtUserPaintMenuBar system call, or more specifically, through the user32! fnINLPUAHDRAWMENUITEM user-mode callback 107 on Windows...