Microsoft Anti-Exploit Tool Protects Against Adobe Zero Day

Although Adobe doesn’t have a patch ready yet for the newly disclosed vulnerability in the company’s Reader application, Adobe and Microsoft security officials said that Microsoft’s recently released Enhanced Mitigation Environment Toolkit 2.0 can protect users against the exploit that is current...

Mozilla Foundation Security Advisory 2010-56

Mozilla Foundation Security Advisory 2010-56 Title: Dangling pointer vulnerability in nsTreeContentView Impact: Critical Announced: September 7, 2010 Reporter: regenrecht Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.9 Firefox 3.5.12 Thunderbird 3.1.3 Thunderbird 3.0.7 SeaMonkey...

Mozilla Foundation Security Advisory 2010-57

Mozilla Foundation Security Advisory 2010-57 Title: Crash and remote code execution in normalizeDocument Impact: Critical Announced: September 7, 2010 Reporter: regenrecht Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.9 Firefox 3.5.12 Thunderbird 3.1.3 Thunderbird 3.0.7 SeaMonke...

New Adobe PDF Zero-Day Flaw Under Attack

Adobe today sounded an alarm for a new zero-day flaw in its PDF Reader/Acrobat software, warning that hackers are actively exploiting the vulnerability in-the-wild. Details on the vulnerability are not yet public but the sudden warning from Adobe is a sure sign that rigged PDF documents are being...

Dangling pointer vulnerability in nsTreeContentView — Mozilla

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that the implementation of XUL 's content view contains a dangling pointer vulnerability. One of the content view's methods for accessing the internal structure of the tree could be manipulated into removing a node pri...

Crash and remote code execution in normalizeDocument — Mozilla

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that code used to normalize a document contained a logical flaw that could be leveraged to run arbitrary code. When the normalization code ran, a static count of the document's child nodes was used in the traversal, so...

Trend Micro Internet Security Pro ActiveX Control extSetOwner code execution

Added: 09/02/2010 CVE: CVE-2010-3189 BID: 42717 OSVDB: 67561 Background Trend Micro Internet Security Pro is a virus protection and Internet security product for home users. Problem A vulnerability in the UfPBCtrl.dll ActiveX control allows command execution when a user loads a web page which cal...

Immunity Canvas: QUICK_PUNK

Name| quickpunk ---|--- CVE| CVE-2010-1818 Exploit Pack| CANVAS Description| quickpunk Notes| CVE Name: CVE-2010-1818 VENDOR: Apple Notes: Abyssec 0day VersionsAffected: 7.6.5 Repeatability: Infinite References: 'http://zerodayinitiative.com/advisories/ZDI-10-168/' CVE Url:...

ZDI-10-166: RealNetworks RealPlayer Malformed IVR Object Index Code Execution Vulnerability

ZDI-10-166: RealNetworks RealPlayer Malformed IVR Object Index Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-166 August 26, 2010 -- CVE ID: CVE-2010-2996 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: RealNetworks -- Affected Products: RealNetworks...

ZDI-10-167: RealNetworks RealPlayer FLV Parsing Multiple Integer Overflow Vulnerabilities

ZDI-10-167: RealNetworks RealPlayer FLV Parsing Multiple Integer Overflow Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-10-167 August 26, 2010 -- CVE ID: CVE-2010-3000 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: RealNetworks -- Affected Products: RealNetworks...

DLL Hijacking: Facts and Fiction

It’s been interesting watching DLL hijacking grow from interesting phenomena to a full-on snowball of hype and FUD over the last few days. As of this writing Google turns up 152 news articles on the subject. The vast majority of coverage is calling this a “new class of attack” and pointing out ho...

ZDI-10-157: IBM Lotus Notes Autonomy KeyView Office Shape Parsing Remote Code Execution Vulnerability

ZDI-10-157: IBM Lotus Notes Autonomy KeyView Office Shape Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-157 August 23, 2010 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: IBM Autonomy -- Affected Products: IBM Lotus Notes Autonomy...

ZDI-10-160: Adobe Shockwave Player Director File FFFFFF45 Record Processing Remote Code Execution Vulnerability

ZDI-10-160: Adobe Shockwave Player Director File FFFFFF45 Record Processing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-160 August 24, 2010 -- CVE ID: CVE-2010-2871 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Adobe -- Affected Products:...

ZDI-10-162: Adobe Shockwave Director rcsL Chunk Remote Code Execution Vulnerability

ZDI-10-162: Adobe Shockwave Director rcsL Chunk Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-162 August 24, 2010 -- CVE ID: CVE-2010-2873 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Adobe -- Affected Products: Adobe Shockwave Player --...

ZDI-10-161: Adobe Shockwave Director PAMI Chunk Remote Code Execution Vulnerability

ZDI-10-161: Adobe Shockwave Director PAMI Chunk Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-161 August 24, 2010 -- CVE ID: CVE-2010-2872 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Adobe -- Affected Products: Adobe Shockwave Player --...

ZDI-10-159: IBM Lotus Notes Autonomy KeyView WK3 Parsing Remote Code Execution Vulnerability

ZDI-10-159: IBM Lotus Notes Autonomy KeyView WK3 Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-159 August 23, 2010 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: IBM Autonomy -- Affected Products: IBM Lotus Notes Autonomy KeyView --...

ZDI-10-158: IBM Lotus Notes Autonomy KeyView WK3 Parsing Remote Code Execution Vulnerability

ZDI-10-158: IBM Lotus Notes Autonomy KeyView WK3 Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-158 August 23, 2010 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: IBM Autonomy -- Affected Products: IBM Lotus Notes Autonomy KeyView --...

Why Vulnerability Research Matters

It seems that any time there’s a high-profile incident in which a vulnerability is disclosed without a patch being available, there is an immediate and loud call from some corners to abolish the practice of vulnerability research. If researchers weren’t spending their days poking holes in softwar...

ZDI-10-152: Apple WebKit RTL LineBox Overflow Remote Code Execution Vulnerability

ZDI-10-152: Apple WebKit RTL LineBox Overflow Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-152 August 11, 2010 -- CVE ID: CVE-2010-0049 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Apple -- Affected Products: Apple WebKit -- Vulnerability...

ZDI-10-153: Apple Webkit SVG Floating Text Element Remote Code Execution Vulnerability

ZDI-10-153: Apple Webkit SVG Floating Text Element Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-153 August 11, 2010 -- CVE ID: CVE-2010-1787 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Apple -- Affected Products: Apple WebKit --...