Adobe Illustrator Out-of-Bounds Write Vulnerability (CNVD-2023-50822)

Adobe Illustrator is a set of vector-based image creation software from the American company Audobee Adobe. Adobe Illustrator suffers from an out-of-bounds write vulnerability that can be exploited by an attacker to cause arbitrary code execution...

imagemagick:ping_fuzzer: Crash in std::__1::vector<unsigned char, std::__1::allocator<unsigned char> >::__swap_out

Detailed Report: https://oss-fuzz.com/testcase?key=5161503392399360 Project: imagemagick Fuzzing Engine: centipede Fuzz Target: pingfuzzer Job Type: centipedeasanimagemagick Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x60b0000227ee Crash State: std::1::vector ::swapout std::1::vector...

Adobe Dimension buffer error vulnerability

Adobe Dimension is a set of 2D and 3D composite design tools from the American company Audobee Adobe. Adobe Dimension suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to cause a sensitive memory leak...

Adobe Dimension buffer error vulnerability

Adobe Dimension is a set of 2D and 3D composite design tools from the American company Audobee Adobe. Adobe Dimension suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to cause a sensitive memory leak...

PT-2023-1837 · Adobe · Substance3D - Stager

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Stager versions 2.0.0 and earlier Description: The issue is a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, where a vict...

PT-2023-1831 · Adobe · Substance3D - Stager

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Stager versions 2.0.0 and earlier Description: The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires use...

Large-scale Cyber Attack Hijacks East Asian Websites for Adult Content Redirects

A widespread malicious cyber operation has hijacked thousands of websites aimed at East Asian audiences to redirect visitors to adult-themed content since early September 2022. The ongoing campaign entails injecting malicious JavaScript code to the hacked websites, often connecting to the target...

Possible Denial of Service Vulnerability in Rack’s header parsing

There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539. Versions Affected: = 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1 Impact Carefully crafted input can cause header parsing in Ra...

const-cstr is Unmaintained

Last release was about five years ago. The maintainers have been unreachable to respond to any issues that may or may not include security issues. The repository is now archived and there is no security policy in place to contact the maintainers otherwise. No direct fork exist. const-cstr is...

Intel® Quartus® Advisory

This advisory contains CVEs in Altera products and has been transferred to Altera for support. The updated advisory can be found at the link below: https://www.altera.com/product-security/advisory-archive/intel-sa-00632.html...

Akuvox E11 security feature vulnerability

Akuvox E11 is a SIP visual doorbell from Akuvox designed for villas, houses and apartments. A security vulnerability exists in Akuvox E11 that stems from the inclusion of a feature that encrypts a message and then forwards it.The IV vector and key are static, which could allow an attacker to...

ImageMagick input validation vulnerability

ImageMagick is a set of open-source image processing software from the American company ImageMagick. The software can read, convert or write images in a variety of formats. A security vulnerability exists in ImageMagick, which stems from a specially crafted SVG that causes segmentation errors. Th...

Debian: Security Advisory (DLA-664-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-251-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cybercriminals Targeting Law Firms with GootLoader and FakeUpdates Malware

Six different law firms were targeted in January and February 2023 as part of two disparate threat campaigns distributing GootLoader and FakeUpdates aka SocGholish malware strains. GootLoader, active since late 2020, is a first-stage downloader that's capable of delivering a wide range of seconda...

CVE-2023-25221

Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the derivespatiallumavectorprediction function in motion.cc...

libde265 buffer error vulnerability

Libde265 is a German h.265 video codec. A security vulnerability exists in libde265 version v1.0.10, which stems from a heap-based buffer overflow found in the derivespatiallumavectorprediction method of the motion.cc file...

CVE-2023-25221

Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the derivespatiallumavectorprediction function in motion.cc...

partial_sort contains Out-of-bounds Read in release mode

Affected versions of this crate were using a debug assertion to validate the last parameter of partialsort. This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions. All writes are bounds-checked, so the out-of-bounds...

CVE-2023-20940

In the Android operating system, there is a possible way to replace a boot partition due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...