Microsoft DirectWrite / AFDKO - Stack Corruption in OpenType Font Handling Due to Negative nAxes

-----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling library written in C, which provides interfaces for reading and writing Type 1, OpenType, TrueType to some...

Microsoft DirectWrite AFDKO - Heap-Based Out-of-Bounds ReadWrite in OpenType Font Handling Due to Empty ROS Strings

Microsoft DirectWrite AFDKO - Heap-Based Out-of-Bounds ReadWrite in OpenType Font Handling Due to Empty ROS Strings -----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font...

Microsoft DirectWrite AFDKO - Multiple Bugs in OpenType Font Handling Related to the _post_ Table

Microsoft DirectWrite AFDKO - Multiple Bugs in OpenType Font Handling Related to the post Table -----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling library...

Microsoft ASP.NET Core CVE-2019-1075 Spoofing Vulnerability

Description Microsoft ASP.NET Core is prone to a spoofing vulnerability because it fails to properly sanitize user-supplied input. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirect...

Microsoft Office SharePoint CVE-2019-1134 Cross Site Scripting Vulnerability

Description Microsoft Office SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

Debian DLA-1846-2 : unzip regression update

The unzip security update issued as DLA 1846-1 caused a regression when building the Firefox web browser from source. There is a zip-like file in the Firefox distribution, omni.ja, which is a zip container with the central directory placed at the start of the file instead of after the local entri...

PHP CVE-2019-11041 Heap Buffer Overflow Vulnerability

Description PHP is prone to a heap-based buffer-overflow vulnerability. Successfully exploiting this issue allow attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions. PHP versions prior to 7.3.8 are vulnerable...

[SECURITY] Fedora 29 Update: firefox-67.0.4-1.fc29

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 30 Update: firefox-67.0.4-1.fc30

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Fedora Update for firefox FEDORA-2019-1ae01e6688

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 29 Update: firefox-67.0.3-1.fc29

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Debian DLA-1829-1 : firefox-esr security update

Samuel Gross discovered a type confusion bug in the JavaScript engine of the Mozilla Firefox web browser, which could result in the execution of arbitrary code when browsing a malicious website. For Debian 8 'Jessie', this problem has been fixed in version 60.7.1esr-1deb8u1. We recommend that you...

Fedora Update for firefox FEDORA-2019-9d9ad2999e

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Debian: Security Advisory (DLA-1829-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross site request forgery (csrf)

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF...

Fedora Update for firefox FEDORA-2019-2cac67b3bc

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: firefox-67.0.3-1.fc30

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Google Chrome < 75.0.3770.90 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 75.0.3770.90. It is, therefore, affected by a vulnerability as referenced in the 201906stable-channel-update-for-desktop13 advisory. - Use after free in Blink in Google Chrome prior to 75.0.3770.90 allowed a remote attack...

Google Chrome < 75.0.3770.90 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 75.0.3770.90. It is, therefore, affected by a vulnerability as referenced in the 201906stable-channel-update-for-desktop13 advisory. - Use after free in Blink in Google Chrome prior to 75.0.3770.90 allowed a remote...

Critical: Red Hat Security Advisory: flash-plugin security update

An update for flash-plugin is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...