Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,535 results · page 78 of 111
Oct 22, 2017IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a craftCVE-2017-15755 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address controls Branch Selection starting at verifier!AVrfpDphFindBusyMemoryNoCheck+0x0000000000000091."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, reCVE-2017-15754 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "User Mode Write AV near NULL starting at BabaCAD4Image!ShowPlugInOptions+0x0000000000013968."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a craftCVE-2017-15753 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address controls Branch Selection starting at BabaCAD4Image!ShowPlugInOptions+0x00000000000029c2."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, reCVE-2017-15752 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to "Data from Faulting Address controls subsequent Write Address starting at BabaCAD4Image!ShowPlugInOptions+0x000000000004d6b0."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a craftCVE-2017-15751 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a "Read Access Violation starting at BabaCAD4Image!ShowPlugInOptions+0x0000000000009f39."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a craftCVE-2017-15750 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a "Read Access Violation starting at BabaCAD4Image!ShowPlugInOptions+0x0000000000009ae0."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a craftCVE-2017-15749 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address controls Branch Selection starting at CADIMAGE+0x00000000000348b9."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, reCVE-2017-15748 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "User Mode Write AV starting at CADIMAGE+0x000000000000613a."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, reCVE-2017-15747 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "Data Execution Prevention Violation starting at Unknown Symbol @ 0x0000700b00260112 called from CADIMAGE+0x00000000003d35ad."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a craftCVE-2017-15746 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address controls Branch Selection starting at CADIMAGE+0x00000000003d21b3."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a craftCVE-2017-15745 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address controls Branch Selection starting at CADIMAGE+0x000000000002ca2e."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, reCVE-2017-15744 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "Read Access Violation on Control Flow starting at CADIMAGE+0x00000000003d35a7."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a craftCVE-2017-15743 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address may be used as a return value starting at CADIMAGE+0x00000000003d24a0."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a craftCVE-2017-15742 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a "Read Access Violation starting at CADIMAGE+0x00000000003d2328."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a craftCVE-2017-15741 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Possible Stack Corruption starting at CADIMAGE+0x00000000003d2378."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, reCVE-2017-15740 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to "Data from Faulting Address controls Code Flow starting at CADIMAGE+0x000000000033228e."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, reCVE-2017-15739 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to "Data from Faulting Address controls subsequent Write Address starting at CADIMAGE+0x00000000000042d5."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a craftCVE-2017-15738 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a "Read Access Violation starting at CADIMAGE+0x00000000003d22d8."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a craftCVE-2017-15737 · Other software · Irfanview · reported by MITREHigh 7.8
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a "Read Access Violation starting at CADIMAGE+0x00000000003d246f."
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php.CVE-2017-15578 · Websites & servers · Phpsugar · reported by MITREHigh 8.8
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php.
- Product
- PHP Melody
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpsugar.comblogs.securiteam.com
Oct 17, 2017In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document.CVE-2017-15565 · Other software · Freedesktop · reported by MITREHigh 8.8
In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document.
- Product
- Poppler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.freedesktop.orglists.debian.org
Oct 16, 2017Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extenCVE-2015-2780 · Other software · Berta · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
- Product
- Berta CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgopenwall.com
Oct 13, 2017An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE imagesCVE-2016-4924 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.4
An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE images and obtain sensitive information contained in them such as private cryptographic keys. This issue was found during internal product security testing. Juniper SIRT is not aware of any malicious exploitation of this vulnerability. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS 15.1 prior to 15.1F5; 14.1 prior to 14.1R8
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.juniper.net
Oct 12, 2017ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other CVE-2017-15281 · Other software · Imagemagick · reported by MITREHigh 8.8
ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to "Conditional jump or move depends on uninitialised value(s)."
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Oct 12, 2017ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a gloCVE-2017-15277 · Other software · Graphicsmagick · reported by MITREMedium 6.5
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.
- Product
- Graphicsmagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2017An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1.CVE-2017-2887 · Other software · Talos · reported by talos-cna@cisco.comHigh 8.8
An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.
- Product
- Simple Direct Media
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdebian.org
Oct 10, 2017ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26 has a use-after-free issue when the height or width is zero, related to ReadJNGImage.CVE-2017-15238 · Other software · Graphicsmagick · reported by MITREHigh 8.8
ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26 has a use-after-free issue when the height or width is zero, related to ReadJNGImage.
- Product
- Graphicsmagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.graphicsmagick.orghg.graphicsmagick.org
Oct 10, 2017In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a meta image, an integer overflowCVE-2017-9683 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a meta image, an integer overflow can occur, if user-defined image offset and size values are too large.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsource.android.com
Oct 10, 2017ImageMagick 7.0.7-2 has a memory leak in ReadOneJNGImage in coders/png.c.CVE-2017-15218 · Other software · Imagemagick · reported by MITREMedium 6.5
ImageMagick 7.0.7-2 has a memory leak in ReadOneJNGImage in coders/png.c.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Oct 10, 2017ImageMagick 7.0.7-2 has a memory leak in ReadSGIImage in coders/sgi.c.CVE-2017-15217 · Other software · Imagemagick · reported by MITREMedium 6.5
ImageMagick 7.0.7-2 has a memory leak in ReadSGIImage in coders/sgi.c.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Oct 6, 2017The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.CVE-2017-15079 · WordPress plugins & themes · reported by MITREHigh 7.5
The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.
- Product
- Smush Image Compression and Optimization
- Fixed in
- 2.7.6
- What to do
- Update Smush Image Compression and Optimization to 2.7.6 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Oct 5, 2017ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c.CVE-2017-15033 · Other software · Imagemagick · reported by MITREHigh 7.5
ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comusn.ubuntu.com
Oct 5, 2017ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.CVE-2017-15032 · Other software · Imagemagick · reported by MITRECritical 9.8
ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comusn.ubuntu.com
Oct 4, 2017ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c.CVE-2017-15017 · Other software · Imagemagick · reported by MITREHigh 8.8
ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Oct 4, 2017ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c.CVE-2017-15016 · Other software · Imagemagick · reported by MITREHigh 8.8
ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comusn.ubuntu.com
Oct 4, 2017ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c.CVE-2017-15015 · Other software · Imagemagick · reported by MITREHigh 8.8
ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Oct 3, 2017GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in codCVE-2017-14997 · Other software · Graphicsmagick · reported by MITREMedium 6.5
GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c.
- Product
- Graphicsmagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.graphicsmagick.orgsecurityfocus.com
Oct 3, 2017ReadDCMImage in coders/dcm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted DICOM image,CVE-2017-14994 · Other software · Graphicsmagick · reported by MITREMedium 6.5
ReadDCMImage in coders/dcm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted DICOM image, related to the ability of DCM_ReadNonNativeImages to yield an image list with zero frames.
- Product
- Graphicsmagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.graphicsmagick.orgsecurityfocus.com
Oct 2, 2017A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, becausCVE-2017-14989 · Other software · Imagemagick · reported by MITREMedium 6.5
A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, because the FT_Done_Glyph function (from FreeType 2) is called at an incorrect place in the ImageMagick code.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comusn.ubuntu.com
Sep 29, 2017ExifImageFile::readDQT in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (stack-based buffer over-read and applicaCVE-2017-14931 · Other software · Openexif Project · reported by MITREMedium 5.5
ExifImageFile::readDQT in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted JPEG file.
- Product
- Openexif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Sep 28, 2017A NULL pointer dereference was discovered in Exiv2::Image::printIFDStructure in image.cpp in Exiv2 0.26.CVE-2017-14863 · Other software · Exiv2 · reported by MITREMedium 5.5
A NULL pointer dereference was discovered in Exiv2::Image::printIFDStructure in image.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
- Product
- Exiv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Sep 28, 2017There is a stack consumption vulnerability in the Exiv2::Internal::stringFormat function of image.cpp in Exiv2 0.26.CVE-2017-14861 · Other software · Exiv2 · reported by MITREMedium 5.5
There is a stack consumption vulnerability in the Exiv2::Internal::stringFormat function of image.cpp in Exiv2 0.26. A Crafted input will lead to a remote denial of service attack.
- Product
- Exiv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Sep 28, 2017There is a heap-based buffer over-read in the Exiv2::Jp2Image::readMetadata function of jp2image.cpp in Exiv2 0.26.CVE-2017-14860 · Other software · Exiv2 · reported by MITREMedium 5.5
There is a heap-based buffer over-read in the Exiv2::Jp2Image::readMetadata function of jp2image.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack.
- Product
- Exiv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Sep 28, 2017In Exiv2 0.26, there is an invalid free in the Image class in image.cpp that leads to a Segmentation fault.CVE-2017-14857 · Other software · Exiv2 · reported by MITREMedium 5.5
In Exiv2 0.26, there is an invalid free in the Image class in image.cpp that leads to a Segmentation fault. A crafted input will lead to a denial of service attack.
- Product
- Exiv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Sep 27, 2017Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handling.CVE-2017-14841 · Other software · Dasinfomedia · reported by MITREMedium 6.5
Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handling.
- Product
- Annual Maintenance Contract Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 26, 2017Multiple unrestricted file upload vulnerabilities in the (1) imageSubmit and (2) proof_submit functions in Claydip Laravel Airbnb Clone 1.0 allow remote authentCVE-2017-14704 · Other software · Claydip · reported by MITREHigh 8.8
Multiple unrestricted file upload vulnerabilities in the (1) imageSubmit and (2) proof_submit functions in Claydip Laravel Airbnb Clone 1.0 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/profile.
- Product
- Airbnb Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 25, 2017The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service (infinite loop) via a crafted fontCVE-2017-14741 · Other software · Imagemagick · reported by MITREMedium 6.5
The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Sep 25, 2017The AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4 mishandles failed memory allocation, which allows remote attackeCVE-2017-14739 · Other software · Imagemagick · reported by MITREHigh 7.5
The AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4 mishandles failed memory allocation, which allows remote attackers to cause a denial of service (NULL Pointer Dereference in DistortImage in MagickCore/distort.c, and application crash) via unspecified vectors.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Sep 25, 2017ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to cause a denial of serCVE-2017-14733 · Other software · Graphicsmagick · reported by MITREMedium 6.5
ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
- Product
- Graphicsmagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.graphicsmagick.orglists.debian.org
Sep 25, 2017SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the CVE-2017-14125 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an add_edit_theme task in the wpdevart_gallery_themes page to wp-admin/admin.php.
- Product
- SQL injection vulnerability in the Responsive Image Gallery
- Fixed in
- 1.2.1
- What to do
- Update SQL injection vulnerability in the Responsive Image Gallery to 1.2.1 or newer.
Full record and what to do →NVD recordseclists.orgwpvulndb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.