6702 matches found
SquirrelMail -- post-authentication remote code execution
SquirrelMail developers report: SquirrelMail 1.4.22 and other versions before 201704270200-SVN allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote...
MySQL -- multiple vulnerabilities
Oracle reports: This Critical Patch Update contains 39 new security fixes for Oracle MySQL. 11 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials...
mozilla -- multiple vulnerabilities
Mozilla Foundation reports: Please reference CVE/URL list for details...
drupal8 -- Drupal Core - Critical - Access Bypass
Drupal Security Team Reports: CVE-2017-6919: Access bypass...
graphite2 -- out-of-bounds write with malicious font
Mozilla Foundation reports: An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products...
chromium -- multiple vulnerabilities
Google Chrome Releases reports: 29 security fixes in this release, including: 695826 High CVE-2017-5057: Type confusion in PDFium. Credit to Guang Gong of Alpha Team, Qihoo 360 694382 High CVE-2017-5058: Heap use after free in Print Preview. Credit to Khalil Zhani 684684 High CVE-2017-5059: Type...
cURL -- TLS session resumption client cert bypass (again)
cURL security advisory: libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the...
raptor2 -- buffer overflow
CVE MITRE reports: raptorxmlwriterstartelementcommon in raptorxmlwriter.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows sometimes seen in raptorqnameformatasxml...
asterisk -- Memory exhaustion on short SCCP packets
The Asterisk project reports: A remote memory exhaustion can be triggered by sending an SCCP packet to Asterisk system with "chanskinny" enabled that is larger than the length of the SCCP header but smaller than the packet length specified in the header. The loop that reads the rest of the packet...
osip -- Improper Restriction of Operations within the Bounds of a Memory Buffer
osip developers reports: In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msgosipbodyparse function defined in osipparser2/osipmessageparse.c, resulting in a remote DoS...
heimdal -- bypass of capath policy
Viktor Dukhovni reports: Commit f469fc6 2010-10-02 inadvertently caused the previous hop realm to not be added to the transit path of issued tickets. This may, in some cases, enable bypass of capath policy in Heimdal versions 1.5 through 7.2. Note, this may break sites that rely on the bug. With...
libsndfile -- multiple vulnerabilities
Agostino Sarubbo, Gentoo reports: CVE-2017-8361 Medium: The flacbuffercopy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted audio file. CVE-2017-8362 Medium: T...
FreeBSD -- Multiple vulnerabilities of ntp
Problem Description: A vulnerability was discovered in the NTP server's parsing of configuration directives. CVE-2017-6464 A vulnerability was found in NTP, in the parsing of packets from the DPTS Clock. CVE-2017-6462 A vulnerability was discovered in the NTP server's parsing of configuration...
BIND -- multiple vulnerabilities
ISC reports: A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other...
asterisk -- Buffer Overrun in PJSIP transaction layer
The Asterisk project reports: A remote crash can be triggered by sending a SIP packet to Asterisk with a specially crafted CSeq header and a Via header with no branch parameter. The issue is that the PJSIP RFC 2543 transaction key generation algorithm does not allocate a large enough buffer. By...
libsamplerate -- multiple vulnerabilities
NVD reports: In libsamplerate before 0.1.9, a buffer over-read occurs in the calcoutputsingle function in srcsinc.c via a crafted audio file...
chromium -- vulnerability
Google Chrome Releases reports: 62 security fixes in this release: 826626 Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28 827492 Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30 813876 High CVE-2018-6087:...
libsndfile -- multiple vulnerabilities
NVD reports: In libsndfile before 1.0.28, an error in the "flacbuffercopy" function flac.c can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file. In libsndfile before 1.0.28, an error in the "headerread" function common.c when handling ID3 tags can be exploited...
django -- multiple vulnerabilities
Django team reports: These release addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible. Open redirect and possible XSS attack via user-supplied numeric redirect URLs Open redirect vulnerability in django.views.static.serve...
xen-kernel -- broken check in memory_exchange() permits PV guest breakout
The Xen Project reports: The XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays. A malicious or buggy 64-bit PV guest may be able to access all of system memory, allowing fo...
libXdmcp -- insufficient entropy generating session keys
The freedesktop and x.org project reports: It was discovered that libXdmcp before 1.1.3 used weak entropy to generate session keys on platforms without arc4randombuf but with getentropy. On a multi-user system using xdmcp, a local attacker could potentially use information available from the...
cURL -- potential memory disclosure
The cURL project reports: There were two bugs in curl's parser for the command line option --write-out or -w for short that would skip the end of string zero byte if the string ended in a % percent or \ backslash, and it would read beyond that buffer in the heap memory and it could then potential...
tiff -- multiple vulnerabilities
NVD reports: Please reference CVE/URL list for details...
chromium -- multiple vulnerabilities
Google Chrome Releases reports: 5 security fixes in this release, including: 698622 Critical CVE-2017-5055: Use after free in printing. Credit to Wadih Matar 699166 High CVE-2017-5054: Heap buffer overflow in V8. Credit to Nicolas Trippar of Zimperium zLabs 662767 High CVE-2017-5052: Bad cast in...
xen-tools -- xenstore denial of service via repeated update
The Xen Project reports: Unprivileged guests may be able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service DoS of the entire host...
phpMyAdmin -- bypass 'no password' restriction
The phpMyAdmin team reports: Summary Bypass $cfg'Servers'$i'AllowNoPassword' Description A vulnerability was discovered where the restrictions caused by $cfg'Servers'$i'AllowNoPassword' = false are bypassed under certain PHP versions. This can allow the login of users who have no password set eve...
asterisk -- Buffer overflow in CDR's set user
The Asterisk project reports: No size checking is done when setting the user field on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. This allows the possibility of remote code injection...
samba -- symlink race allows access outside share definition
Samba team reports: A time-of-check, time-of-use race condition can allow clients to access non-exported parts of the file system via symlinks...
codeigniter -- multiple vulnerabilities
The CodeIgniter changelog reports: Fixed a header injection vulnerability in common function setstatusheader under Apache thanks to Guillermo Caminer from Flowgate. Fixed byte-safety issues in Encrypt Library DEPRECATED when mbstring.funcoverload is enabled. Fixed byte-safety issues in Encryption...
gitlab -- Various security issues
GitLab reports: Information Disclosure in Issue and Merge Request Trackers During an internal code review a critical vulnerability in the GitLab Issue and Merge Request trackers was discovered. This vulnerability could allow a user with access to assign ownership of an issue or merge request to...
NSS -- multiple vulnerabilities
Mozilla Foundation reports: An out-of-bounds write during Base64 decoding operation in the Network Security Services NSS library due to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The NSS library has been updated to fix this issue to address...
firefox -- integer overflow in createImageBitmap()
The Mozilla Foundation reports: An integer overflow in createImageBitmap was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the createImageBitmap API. This function runs in the content sandbox, requiring a second vulnerability to...
squashfs-tools -- Integer overflow
Phillip Lougher reports: Integer overflow in the readfragmenttable4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service application crash via a crafted input, which triggers a stack-based buffer overflow...
chicken -- multiple vulnerabilities
CHICKEN reports: CVE-2017-6949: Unchecked malloc call in SRFI-4 constructors when allocating in non-GC memory, resulting in potential 1-word buffer overrun and/or segfault CVE-2017-9334: "length" crashes on improper lists CVE-2017-11343: The randomization factor of the symbol table was set before...
drupal8 -- multiple vulnerabilities
Drupal Security Team reports: CVE-2017-6377: Editor module incorrectly checks access to inline private files CVE-2017-6379: Some admin paths were not protected with a CSRF token CVE-2017-6381: Remote code execution...
xen-tools -- Cirrus VGA Heap overflow via display refresh
The Xen Project reports: A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process...
id Tech 3 -- remote code execution vulnerability
The content auto-download of id Tech 3 can be used to deliver maliciously crafted content, that triggers downloading of further content and loading and executing it as native code with user credentials. This affects ioquake3, ioUrbanTerror, OpenArena, the original Quake 3 Arena and other forks...
Flash Player -- multiple vulnerabilities
Adobe reports: These updates resolve a buffer overflow vulnerability that could lead to code execution CVE-2017-2997. These updates resolve memory corruption vulnerabilities that could lead to code execution CVE-2017-2998, CVE-2017-2999. These updates resolve a random number generator vulnerabili...
moodle -- multiple vulnerabilities
Marina Glancy reports: In addition to a number of bug fixes and small improvements, security vulnerabilities have been discovered and fixed. We highly recommend that you upgrade your sites as soon as possible. Upgrading should be very straightforward. As per our usual policy, admins of all...
irssi -- use-after-free potential code execution
The irssi project reports: Use after free while producing list of netjoins CWE-416. This issue was found and reported to us by APic. This issue usually leads to segmentation faults. Targeted code execution should be difficult...
mbed TLS (PolarSSL) -- multiple vulnerabilities
Janos Follath reports: If a malicious peer supplies a certificate with a specially crafted secp224k1 public key, then an attacker can cause the server or client to attempt to free block of memory held on stack. Depending on the platform, this could result in a Denial of Service client crash or...
chromium -- multiple vulnerabilities
Google Chrome Releases reports: 36 security fixes in this release Please reference CVE/URL list for details...
wordpress -- multiple vulnerabilities
WordPress versions 4.7.2 and earlier are affected by six security issues. Cross-site scripting XSS via media file metadata. Control characters can trick redirect URL validation. Unintended files can be deleted by administrators using the plugin deletion functionality. Cross-site scripting XSS via...
mozilla -- multiple vulnerabilities
Mozilla Foundation reports: Please reference CVE/URL list for details...
proftpd -- user chroot escape vulnerability
NVD reports: ProFTPD ... controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks...
ImageMagick -- multiple vulnerabilities
Please reference CVE/URL list for details...
zziplib - multiple vulnerabilities
NIST reports by search in the range 2017/01/01 - 2018/07/06: 17 security fixes in this release: Heap-based buffer overflow in the zzipget32 function in fetch.c. Heap-based buffer overflow in the zzipget64 function in fetch.c. Heap-based buffer overflow in the zzipmementryextrablock function in...
kio: Information Leak when accessing https when using a malicious PAC file
Albert Astals Cid reports: Using a malicious PAC file, and then using exfiltration methods in the PAC function FindProxyForURL enables the attacker to expose full https URLs. This is a security issue since https URLs may contain sensitive information in the URL authentication part...
kdepimlibs -- directory traversal on KTNEF
Albert Aastals Cid reports: A directory traversal issue was found in KTNEF which can be exploited by tricking a user into opening a malicious winmail.dat file. The issue allows to write files with the permission of the user opening the winmail.dat file during extraction...
tnef -- Invalid read and write operations, controlled by an attacker
[email protected] reports: CVE-2017-6307: An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapiattr.c:mapiattrread. These might lead to invalid read and write operations, controlled by an attacker. CVE-2017-6308: An issue was discovered in tnef before 1.4.13...