3966 matches found
CVE-2015-4495
CVE-2015-4495 affects Mozilla Firefox's built-in PDF viewer. The vulnerability allows remote attackers to bypass the Same Origin Policy and read arbitrary files or gain privileges via crafted JavaScript and a native setter, in Firefox versions before 39.0.3, Firefox ESR 38.x before 38.1.1, and Fi...
CVE-2015-2863
Kaseya Virtual System Administrator (VSA) Open Redirect (CVE-2015-2863) affects VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4. An attacker can redirect users to arbitrary sites to facilitate phishing via unspecified vectors. Remediation per sources: app...
CVE-2015-2426
CVE-2015-2426 is a Windows OpenType Font Driver vulnerability (ATMFD.DLL) that causes a pool/heap overflow when processing OpenType fonts, allowing remote code execution. The issue arises from a flawed handling of font data (notably the Class1Count field in the GPOS/CFF paths) where an invalid ze...
CVE-2015-2590
CVE-2015-2590 is an unspecified vulnerability affecting Oracle Java SE (6u95, 7u80, 8u45) and Java SE Embedded (7u75, 8u33) with impact to confidentiality, integrity, and availability via unknown vectors in the Libraries component. Public details in the initial description are limited; connected ...
CVE-2015-4732
CVE-2015-4732 is described in connected advisories as an unspecified vulnerability in the OpenJDK Libraries component, with complete confidentiality, integrity, and availability impact. It affects Oracle Java SE 6u95, 7u80, 8u45 and Java SE Embedded 7u75, 8u33 (per the initial entry) and is refle...
CVE-2015-2387
CVE-2015-2387 discusses a local privilege-escalation in the ATMFD.DLL component of the Windows Adobe Type Manager Font Driver. Concrete details from connected sources show multiple OTF/TTF vulnerabilities in ATMFD.DLL (and related font subsystems) that allowed memory corruption via crafted font d...
CVE-2015-2384
CVE-2015-2384 is a Microsoft Internet Explorer 11 memory-corruption vulnerability exploitable via a crafted web site, potentially leading to remote code execution or DoS. The connected sources confirm the same class of issue (IE11 memory corruption) and tie this CVE to MS15-065 (Cumulative Securi...
CVE-2015-2419
CVE-2015-2419 is a JScript 9 vulnerability in Microsoft Internet Explorer (IE10/IE11) that allows remote code execution and memory corruption when processing crafted JSON with JSON.stringify. The CVE is exploited via malicious web content and has been leveraged by loaders in exploit kits (notably...
CVE-2015-2425
Technical details about CVE-2015-2425 are not publicly available in the provided connected documents. Current sources confirm IE11 memory corruption remote code execution vector, but specifics (affected versions, root cause, fixes) are not disclosed here. Monitor for updates.
CVE-2015-2383
CVE-2015-2425, as documented in the CVE list and CIRCL sightings, is a memory-corruption vulnerability in Microsoft Internet Explorer 11 that allows remote attackers to run arbitrary code or cause a denial of service by presenting a crafted web site. The issue is explicitly described as distinct ...
CVE-2015-2424
CVE-2015-2424: Microsoft Office memory corruption in PowerPoint/Word components allows remote code execution or memory corruption via a crafted Office document. Affected products include PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, an...
CVE-2015-5122
CVE-2015-5122 involves a Use-After-Free in the DisplayObject class of the AS3 Flash Player. It affects Flash Player 13.x–18.x on Windows/macOS, 11.x–11.2.x on Linux, and 12.x–18.0.0.204 on Linux Chrome. The flaw, triggered by improper handling of the opaqueBackground property, enables remote code...
CVE-2015-5123
CVE-2015-5123 describes a use-after-free in the BitmapData class of the ActionScript 3 (AS3) implementation in Adobe Flash Player . The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) by crafting Flash content that overrides a value...
CVE-2015-4620
Vulnerability CVE-2015-4620 affects ISC BIND when configured as a DNSSEC-validating recursive resolver. name.c in BIND 9.7.x–9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2 can crash the server (assertion failure and daemon exit) after crafting zone data and issuing a query for a name in that z...
CVE-2015-5119
The CVE-2015-5119 entry documents a use-after-free in Adobe Flash Player’s AS3 ByteArray class. The vulnerability arises when a crafted valueOf override in an object causes the ByteArray storage to be reallocated during a write ba[0] = obj, leading to memory corruption and potential remote code e...
CVE-2015-3113
CVE-2015-3113 is a heap-based buffer overflow in Adobe Flash Player affecting Windows/macOS Flash parsing of FLV data, exploited in the wild in June 2015. Affected versions: Flash Player before 13.0.0.296, and 14.x up to 18.x before 18.0.0.194 on Windows/macOS; before 11.2.202.468 on Linux. The f...
CVE-2015-2360
CVE-2015-2360 is a local privilege-escalation in Windows kernel-mode driver Win32k.sys affecting multiple Windows versions (Server 2003 SP2/R2 SP2, Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, 8/8.1, Server 2012/2012 R2, RT/RT 8.1). The underlying issue is in Win32k.sys that allows crafted a...
CVE-2015-1770
CVE-2015-1770 affects Microsoft Office 2013 SP1 and Office 2013 RT SP1, via uninitialized memory use in Office components when processing crafted Office documents, enabling remote code execution. The vulnerability’s impact is high (CVE/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with network vector and ...
CVE-2015-4335
CVE-2015-4335: Redis EVAL Lua sandbox escape . The vulnerability affects Redis up to 2.8.21 and 3.x up to 3.0.2, where remote attackers could abuse the EVAL Lua command to execute arbitrary Lua bytecode, potentially escaping the sandbox and running code with Redis process privileges. Debian’s adv...