BlackArch Linux v2017.08.30 - Penetration Testing Distribution

BlackArch Linux is an Arch Linux-based distribution for penetration testers and security researchers. The repository contains 1859 tools. You can install tools individually or in groups. BlackArch Linux is compatible with existing Arch installs. ChangeLog: added more than 50 new tools bugfix:...

UBUNTU-CVE-2017-14106

The tcpdisconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of service tcpselectwindow divide-by-zero error and system crash by triggering a disconnect within a certain tcprecvmsg code path...

BSA-2017-371

Security Advisory ID : BSA-2017-371 Component : OpenSSH Revision : 1.0: Interim ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an ...

Mozilla: Use-after-free with marquee during window resizing

A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox...

SUSE-SU-2017:2217-1 Security update for gnome-shell

This update for gnome-shell provides the following fixes: - Fix not intuitive login screen for root user bsc1047262 - Disable session selection button when it's hidden in user switch dialog bsc1034584, bsc1034827 - Fix app windows overlay app list in overview screen bsc1008539 - Properly handle...

Mozilla: Use-after-free with marquee during window resizing

A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox...

Unspecified Vulnerability in Oracle Java SE (CNVD-2017-28228)

Oracle Java SE is the United States Oracle Oracle company's set of standard version of the Java platform for the development and deployment of desktop, server, and embedded devices and real-time environments in the Java application. A security vulnerability exists in the AWT subcomponent of the...

UBUNTU-CVE-2017-7801

A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox...

CVE-2017-7801

A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox...

CVE-2017-7801

A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox...

Win + G Pop Up Citrix Receiver Launching Apps/Desktops

When launching published apps or desktops from a Windows 10 OS a green popup windows briefly appears prompting to press Win + G for the game bar or for the search bar...

A new era in mobile banking Trojans

In mid-July 2017, we found a new modification of the well-known mobile banking malware family Svpeng – Trojan-Banker.AndroidOS.Svpeng.ae. In this modification, the cybercriminals have added new functionality: it now also works as a keylogger, stealing entered text through the use of accessibility...

CVE-2017-11717

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page...

OpenJDK: insufficient access control checks in ImageWatched (AWT, 8174098)

Vulnerability in the Java SE component of Oracle Java SE subcomponent: AWT. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attac...

The vulnerability of the ReadXWDImage function in the console-based image editing tool ImageMagick allows a hacker to trigger a memory exhaustion condition.

The vulnerability of the ReadXWDImage function in the console-based image editing tool ImageMagick is related to resource management errors. Exploiting this vulnerability can allow an attacker, operating remotely, to cause memory exhaustion by manipulating the length the number of color table...

DEBIAN-CVE-2017-1000035

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack...

UBUNTU-CVE-2017-1000035

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack...

Juniper Junos Administrator Privilege Acquisition Vulnerability (CNVD-2017-21782)

Juniper Junos is a network operating system dedicated to the company's hardware systems. An administrator privilege acquisition vulnerability exists in the Juniper Junos command line window, which could be exploited by a local attacker to gain administrator privileges...

Unspecified Vulnerability in Oracle Java SE (CNVD-2017-15714)

Oracle Java SE is the United States Oracle Oracle company's set of standard version of the Java platform for the development and deployment of desktop, server, and embedded devices and real-time environments in the Java application. A security vulnerability exists in the AWT subcomponent of Oracl...

UBUNTU-CVE-2017-11166

The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length number of color-map entries field in the header of an XWD file...