Code injection

In libsndfile before 1.0.28, an error in the "flacbuffercopy" function flac.c can be exploited to cause a segmentation violation with read memory access via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585...

CVE-2017-7741

CVE-2017-7741 affects libsndfile prior to 1.0.28. The flaw is in flac_buffer_copy() (flac.c) and can cause a segmentation fault with write memory access during a resample of a specially crafted FLAC file, similar to CVE-2017-7585. Connected sources confirm the vulnerability in libsndfile and reco...

CVE-2017-7741

In libsndfile before 1.0.28, an error in the "flacbuffercopy" function flac.c can be exploited to cause a segmentation violation with write memory access via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585...

CVE-2017-7742

In libsndfile before 1.0.28, an error in the "flacbuffercopy" function flac.c can be exploited to cause a segmentation violation with read memory access via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585...

CVE-2017-7741

In libsndfile before 1.0.28, an error in the "flacbuffercopy" function flac.c can be exploited to cause a segmentation violation with write memory access via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585...

CVE-2017-7742

In libsndfile before 1.0.28, an error in the "flacbuffercopy" function flac.c can be exploited to cause a segmentation violation with read memory access via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585...

CVE-2017-7742

CVE-2017-7742 affects libsndfile prior to 1.0.28. The issue lies in the flac_buffer_copy() function (flac.c), allowing a specially crafted FLAC file to trigger a segmentation fault via a resample operation (read access). This is the same class of issue as CVE-2017-7585. Public references note the...

MATESO GmbH Password Safe And Repository Enterprise 7.4.4 Build 2247 SQL Injection Vulnerability

Exploit for multiple platform in category web applications Products: Password Safe and Repository Enterprise Manufacturer: MATESO GmbH Affected Versions: 7.4.4 Build 2247 Tested Versions: 7.4.4 Build 2247 Vulnerability Type: Violation of Secure Design Principles CWE-657 SQL Injection CWE-89 Risk...

Apple WebKit / Safari 10.0.3 (12602.4.8) - Synchronous Page Load Universal Cross-Site Scripting

URL scriptURL; URL url; if protocolIsJavaScripturlString scriptURL = completeURLurlString; // completeURL encodes the URL. url = blankURL; else url = completeURLurlString; if shouldConvertInvalidURLsToBlank && !url.isValid url = blankURL; Frame frame = loadOrRedirectSubframeownerElement, url,...

libsndfile -- multiple vulnerabilities

NVD reports: In libsndfile before 1.0.28, an error in the "flacbuffercopy" function flac.c can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file. In libsndfile before 1.0.28, an error in the "headerread" function common.c when handling ID3 tags can be exploited...

WebKit: UXSS via a synchronous page load（CVE-2017-2480）

Here's a snippet of the method SubframeLoader::requestFrame which is invoked when the |src| of an iframe object is changed. bool SubframeLoader::requestFrameHTMLFrameOwnerElement& ownerElement, const String& urlString, const AtomicString& frameName, LockHistory lockHistory, LockBackForwardList...

Type confusion

runtime/JSONObject.cpp in JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service segmentation violation and application crash via crafted JavaScript code that triggers a "type confusion" in the JSON.stringify function...

CVE-2016-10222

runtime/JSONObject.cpp in JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service segmentation violation and application crash via crafted JavaScript code that triggers a "type confusion" in the JSON.stringify function...

CVE-2016-7541

Long lived sessions in Fortinet FortiGate devices with FortiOS 5.x before 5.4.0 could violate a security policy during IPS signature updates when the FortiGate's IPSengine is configured in flow mode. All FortiGate versions with IPS configured in proxy mode the default mode are not affected...

CVE-2016-7541

Fortinet FortiOS/FortiGate FortiGate devices with IPSengine configured in flow mode are affected by CVE-2016-7541. In FortiOS 5.x versions prior to 5.4.0, long‑lived sessions could violate an active security policy during IPS signature updates when the IPS engine is in flow mode; FortiGate device...

CVE-2016-7541

Long lived sessions in Fortinet FortiGate devices with FortiOS 5.x before 5.4.0 could violate a security policy during IPS signature updates when the FortiGate's IPSengine is configured in flow mode. All FortiGate versions with IPS configured in proxy mode the default mode are not affected...

Microsoft Outlook - HTML Email Denial of Service

Microsoft Outlook - HTML Email Denial of Service Source: https://justhaifei1.blogspot.ca/2017/03/an-interesting-outlook-bug.html When you send this email to someone, when he/she just read the email, Outlook will crash. MSRC told me that they think it's a non-exploitable bug and it seems that they...

The vulnerability of the Flash Player software, which allows a violator to execute arbitrary code

The vulnerability of the Primetime TVSDK software platform’s Flash Player component is due to a violation of the buffer’s initial limit. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

Microsoft IE: textarea.defaultValue memory disclosure (CVE-2017-0059)

There is an use-after-free bug in IE which can lead to info leak / memory disclosure. The bug was confirmed on Internet Explorer version 11.0.9600.18537 update version 11.0.38 PoC: function run var textarea = document.getElementById"textarea"; var frame = document.createElement"iframe";...

CVE-2017-7186

libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service segmentation violation for read access, and application crash by triggering an invalid Unicode property lookup...