Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability.”
Monthly Archives: April 2015
CVE-2015-1661 (internet_explorer)
Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka “Internet Explorer ASLR Bypass Vulnerability.”
CVE-2015-1662 (internet_explorer)
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability,” a different vulnerability than CVE-2015-1659 and CVE-2015-1665.
CVE-2015-1665 (internet_explorer)
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability,” a different vulnerability than CVE-2015-1659 and CVE-2015-1662.
CVE-2015-1666 (internet_explorer)
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability,” a different vulnerability than CVE-2015-1652.
CVE-2015-1667 (internet_explorer)
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability.”
CVE-2015-1668 (internet_explorer)
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability.”
Fedora EPEL 7 Security Update: qt5-qtbase-5.4.1-9.el7
Resolved Bugs
1210675 – Invalid bug number
1210673 – Invalid bug number
1210674 – Invalid bug number<br
Multiple vulnerabilities were found in Qt image format handling of BMP, ICO and GIF files. The issues exposed included denial of service and buffer overflows leading to heap corruption. It is possible the latter could be used to perform remote code execution.
See also http://lists.qt-project.org/pipermail/announce/2015-April/000067.html
Fedora EPEL 6 Security Update: seamonkey-2.28-5.ESR_31.6.0.el6
Update to the codebase of Extended Support Release (ESR) 31.6.0
Fixes various security issues, see https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html and https://www.mozilla.org/security/known-vulnerabilities/thunderbird.html for more info
Problems in automatic crash analysis frameworks
Posted by Tavis Ormandy on Apr 14
Hello, this is CVE-2015-1318 and CVE-2015-1862 (essentially the same bugs in
two different implementations, apport and abrt respectively). These were
discussed on the vendors list last week.
If the first character of kern.core_pattern sysctl is a pipe, the kernel
will invoke the specified program, and pass it the core on stdin. Apport
(Ubuntu) and Abrt (Fedora) use this feature to analyze and log crashes.
Since the introduction of containers,…