CentOS 5 / 6 / 7 : thunderbird (CESA-2016:2825)

An update for thunderbird is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

Mozilla Firefox SVG animation nsSMILTimeContainer use-after-free vulnerability

Overview Mozilla Firefox contains a use-after-free vulnerability in the SVG animation functionality, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Mozilla Firefox supports SVG animation through the use of SMIL. The...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

MGASA-2016-0403 Updated chromium-browser-stable packages fix security vulnerabilities

Multiple flaws were found in Chromium's processing of web content where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. CVE-2016-5181, CVE-2016-5182, CVE-2016-5183, CVE-2016-5184, CVE-2016-5185, CVE-2016-518...

Updated chromium-browser-stable packages fix security vulnerabilities

Multiple flaws were found in Chromium's processing of web content where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. CVE-2016-5181, CVE-2016-5182, CVE-2016-5183, CVE-2016-5184, CVE-2016-5185, CVE-2016-518...

U.S. Dept Of Defense: Insecure direct object reference vulnerability on a DoD website

A Department of Defense website was vulnerable to an insecure direct object reference vulnerability IDOR which may allow an attacker to modify web content or certain database parameters. @uranium238 was able to demonstrate this vulnerability by manipulating web objects in a particular way. Very...

U.S. Dept Of Defense: Stored cross site scripting (XSS) vulnerability on a DoD website

A stored cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ahsantahir was able to demonstrate this vulnerability by crafting a...

U.S. Dept Of Defense: Cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting XSS vulnerability was found on a Department of Defense. XSS vulnerabilities can be used to trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ juliocesar able to demonstrate this vulnerability b...

IBM Web Content Manager Production Analytics Cross-Site Scripting Vulnerability

IBM Web Content Manager Production Analytics is a product of IBM Corporation, USA. A cross-site scripting vulnerability exists in IBM Web Content Manager Production Analytics, which can be exploited by an attacker to inject arbitrary JavaScript code into the Web UI...

U.S. Dept Of Defense: Reflected XSS on an Army website

A U.S. Army website was vulnerable to a cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. juliocesar was able to demonstrate this vulnerability by crafting a specially formatte...

Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20161116)

This update upgrades Firefox to version 45.5.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

U.S. Dept Of Defense: Reflected XSS on a Department of Defense website

A Department of Defense website was vulnerable to a reflected cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. juliocesar was able to demonstrate this vulnerability by craftin...

U.S. Dept Of Defense: Reflected XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @yaworskwas able to demonstrate this vulnerability by crafting a specially...

Updated nss and firefox packages fix security vulnerabilities

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2016-5296, CVE-2016-5297, CVE-2016-9066, CVE-2016-5291,...

MGASA-2016-0379 Updated nss and firefox packages fix security vulnerabilities

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2016-5296, CVE-2016-5297, CVE-2016-9066, CVE-2016-5291,...

CVE-2016-7209

CVE-2016-7209 is a Microsoft Edge spoofing vulnerability. Microsoft browsers could be tricked into displaying content from a crafted website by exploiting HTTP response parsing weaknesses. Exploitation requires user interaction (e.g., clicking a link) or visiting a malicious site, per MSRC detail...

Security update for Mozilla Firefox (important)

Mozilla Firefox was updated to 49.0.2 to fix two security issues and some bugs. The following vulnerabilities were fixed: CVE-2016-5287: Crash in nsTArraybase bsc1006475 CVE-2016-5288: Web content can read cache entries bsc1006476 The following changes and fixes are included: Asynchronous renderi...

Apple iTunes memory corruption vulnerability (CNVD-2016-10564)

Apple iTunes for Windows is a suite of Windows-based media player applications from Apple Inc. that are used to play and manage digital music and video files. A memory corruption vulnerability exists in Apple iTunes for Windows versions prior to 12.5.2. The vulnerability can be exploited by a...

About the security content of iTunes 12.5.2 for Windows - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

Apple Patches iOS Flaw Exploitable by Malicious JPEG

Apple on Monday patched a code execution vulnerability in iOS that could be exploited via a JPEG file crafted to take advantage of the flaw. Apple also issued its first round of patches for macOS Sierra as part of a large update that also included fixes for vulnerabilities found in Safari, Apple...