FreeBSD : curl -- multiple vulnerabilities (e0ab1773-07c1-46c6-9170-4c5e81c00927)

curl security problems : CVE-2018-16839: SASL password overflow via integer overflow libcurl contains a buffer overrun in the SASL authentication code. The internal function Curlauthcreateplainmessage fails to correctly verify that the passed in lengths for name and password aren't too long, then...

Out-of-Bounds Read

libcurl.so is vulnerable to a out-of-bounds read. The warning message display function does not format the display information correctly when a warning is longer than 80 bytes, leading to an out-of-bounds read that can disclose sensitive information from the buffer or crash the application...

warning message out-of-buffer read

curl contains a heap out of buffer read vulnerability. The command line tool has a generic function for displaying warning and informational messages to stderr for various situations. For example if an unknown command line argument is used, or passed to it in a "config" file. This display functio...

Security fix for the ALT Linux 8 package curl version 7.62.0-alt1

Oct. 31, 2018 Anton Farygin 7.62.0-alt1 - 7.62.0 - fixes: CVE-2018-16839 - buffer overrun in the SASL authentication code. CVE-2018-16840 - use-after-free in handle close CVE-2018-16842 - warning message out-of-buffer read...

PoC Attack Leverages Microsoft Office and YouTube to Deliver Malware

A stealthy malware delivery tactic has been uncovered in the way videos are embedded into Microsoft Word Documents, according to researchers. It allows JavaScript code-execution when a user clicks on a weaponized YouTube video thumbnail within a Word document – with no alert message displayed by...

Mozilla Firefox Mixed Content Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 63. A remote attacker could exploit this vulnerability to cause the mixed content warning to fail to display...

Mozilla Firefox < 63.0

The version of Firefox installed on the remote Windows host is prior to 63.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-26 advisory. - When manipulating user events in nested loops while opening a document through script, it is possible to trigger a...

chromium-browser: Security UI occlusion in full screen mode

Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...

Mozilla Firefox Security Advisories (MFSA2018-25, MFSA2018-27) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

CVE-2018-12403

If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. This vulnerability affects Firefox 63...

UBUNTU-CVE-2018-12397

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This...

SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2018:2322-2)

This update for MozillaFirefox to version ESR 52.9 fixes the following issues : CVE-2018-5188: Various memory safety bugs bsc1098998 CVE-2018-12368: No warning when opening executable SettingContent-ms files CVE-2018-12366: Invalid data handling during QCMS transformations CVE-2018-12365:...

CVE-2018-12368

Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. Th...

CVE-2018-17476

Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...

CVE-2018-17471

Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...

Microsoft Edge browser-explosive high-risk vulnerabilities, controlled by computer-executable any command-vulnerability warning-the black bar safety net

10 on 12 May, security researchers released a Windows Shell REC（ CVE-2018-8495, the vulnerability proof of concept code, the affected software for Windows 10 built-in Microsoft Edge, the attacker can use the code through the Microsoft Edge browser on the remote computer to run malicious code. It ...

Fortinet FortiGate 5.x < 5.6.6 / 6.x < 6.0.2 Private IP and Hostname Information Disclosure (FG-IR-18-085)

The remote host is running FortiOS 5.x prior to 5.6.6 or 6.x prior to 6.0.2. It is, therefore, affected by a private ip and hostname information disclosure vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid117936; scriptversion"1.5";...

Apple iTunes < 12.8 Multiple Vulnerabilities (uncredentialed check)

The version of Apple iTunes installed on the remote Windows host is prior to 12.8. It is, therefore, affected by multiple vulnerabilities in WebKit as referenced in the HT208933 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported...

Information Disclosure Vulnerability in Multiple IBM Products (CNVD-2018-20095)

IBM Spectrum Protect formerly known as Tivoli Storage Manager is a suite of data protection platforms from U.S.-based IBM that provides organizations with a single point of control and management, and support for backup and recovery of virtual, physical and cloud environments of all sizes. An...

Linux - #VMA Use-After-Free via Buggy vmacache_flush_all() Fastpath Exploit

Exploit for linux platform in category local exploits Linux - VMA Use-After-Free via Buggy vmacacheflushall Fastpath Exploit Since commit 615d6e8756c8 "mm: per-thread vma caching", first in 3.15, Linux has per-task VMA caches that contain up to four VMA pointers for fast lookup. VMA caches are...