3138 matches found
FreeBSD : libidn -- out-of-bounds read issue with invalid UTF-8 input (4caf01e2-30e6-11e5-a4a5-002590263bf5)
Simon Josefsson reports : stringpreputf8toucs4 now rejects invalid UTF-8. This function has always been documented to not validate that the input UTF-8 string is actually valid UTF-8... %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...
Low: Red Hat Security Advisory: grep security, bug fix, and enhancement update
Updated grep packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...
[SECURITY] [DLA 277-1] libidn security update
Package : libidn Version : 1.15-2+deb6u1 CVE ID : CVE-2015-2059 Thijs Alkemade discovered that the Jabber server may pass an invalid UTF-8 string to libidn, the GNU library for Internationalized Domain Names IDNs. In the case of the Jabber server, this results in information disclosure, and it is...
Debian DLA-277-1 : libidn security update
Thijs Alkemade discovered that the Jabber server may pass an invalid UTF-8 string to libidn, the GNU library for Internationalized Domain Names IDNs. In the case of the Jabber server, this results in information disclosure, and it is likely that some other applications using libidn have similar...
DLA-277-1 libidn - security update
Bulletin has no description...
CVE-2015-5380
The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a deni...
CVE-2015-5380
CVE-2015-5380 affects Google V8 (as used by Node.js and io.js) where Utf8DecoderBase::WriteUtf16Slow may not verify memory for a UTF-16 surrogate pair. This can enable a remote attacker to trigger denial of service via a crafted byte sequence, potentially causing memory corruption. Affected versi...
MGASA-2015-0259 Updated coreutils package fixes security vulnerability
Buffer overflows in sort related to the usage of UTF-8 characters CVE-2015-4041, CVE-2015-4042...
Updated coreutils package fixes security vulnerability
Buffer overflows in sort related to the usage of UTF-8 characters CVE-2015-4041, CVE-2015-4042...
node, iojs, and v8 -- denial of service
node reports: This release of Node.js fixes a bug that triggers an out-of-band write in V8's utf-8 decoder. This bug impacts all Buffer to String conversions. This is an important security update as this bug can be used to cause a denial of service attack...
Apple iOS memory corruption
A combination of UTF-8 characters leads to memory corruption...
Fedora 21 : dovecot-2.2.16-2.fc21 (2015-7089)
fixes CVE-2015-3420: SSL/TLS handshake failures leading to a crash of the login process - dovecot updated to 2.2.16 - auth: Don't crash if master user login is attempted without any configured master=yes passdbs - Parsing UTF-8 text for mails could have caused broken results sometimes if bufferin...
ownCloud Server Arbitrary File Upload Vulnerability
ownCloud is an open source private cloud server. The ownCloud Server has a security vulnerability that allows authenticated users to bypass the file blacklist list and upload arbitrary files, such as .htaccess files, via UTF-8 encoded file paths...
CVE-2015-3013
ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file...
CVE-2015-3013
ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file...
CVE-2015-3013
ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file...
Fedora 22 : dovecot-2.2.16-2.fc22 (2015-7156)
fixes CVE-2015-3420: SSL/TLS handshake failures leading to a crash of the login process - dovecot updated to 2.2.16 - auth: Don't crash if master user login is attempted without any configured master=yes passdbs - Parsing UTF-8 text for mails could have caused broken results sometimes if bufferin...
[ MDVSA-2015:199 ] less
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:199 http://www.mandriva.com/en/support/security/ Package : less Date : April 10, 2015 Affected: Business Server 1.0, Business Server 2.0 Problem Description: Updated less package fixes security vulnerability...
GNU less 'is_utf8_well_formed()' remote buffer overflow vulnerability
GNU less is a More-like program in GNU, a free software engineering project. GNU less 'isutf8wellformed' remote buffer overflow vulnerability. Allows remote attackers to exploit this vulnerability to crash an application...