The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.
Monthly Archives: February 2016
CVE-2016-1522
Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.
CVE-2016-1523
The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.
CVE-2016-1524
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via a direct request for a /null URI.
CVE-2016-1525
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. (dot dot) in the realName parameter.
CVE-2016-1949
Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a request for a crossdomain.xml file.
CVE-2016-1526
The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.
5 questions with Timmy Forson: Business Support Hall-of-Famer
Business support Hall-of-Famer, Timmy Forson
Timothy “Timmy” Forson is one of Avast’s business products finest Support Specialists. He began working at Avast on June 1st, 2015. We sat down to learn more about one of our support Hall-of-Famers. This is 5 questions with Timmy!
1. What is your role at Avast Software?
Senior Support Specialist. Basically I support all our business solution customers, from Endpoint and Server protection to Avast for Business via email, phone, and chat. I work from our Charlotte, North Carolina office.
2. What is your approach to supporting customers?
First, I analyze the customer’s issues one step at a time, this way I can gather a clear and concise picture of the overall problem. Then through a streamlined method of troubleshooting, I can provide a solution for the customer’s issue and communicate that as plainly as possible.
In this, I am not only solving the customer’s issue but also educating the customer about what caused the issue and how it can be further avoided. This way the customer walks away truly feeling how much they mean to us and not just like another number to the company. We want our customers to have a positive experience with support.
3. What is your favorite part of chat support?
Not knowing what will show up in chat next. It is very rewarding taking someone’s bad day and turning it around just like that.
4. A lot of us have been “that customer,” the one that runs to support for something obvious. What is the funniest issue you’ve ever had to resolve? (KEEP IT G-RATED TIMMY ) ![]()
This would have to be a customer that came into chat one day and needed help downloading the installer file from the console. I asked the customer to click on the blue “add new devices” button. They looked all over that page for the button and could not find it….about 30 seconds later they reply ”…oh…the blinking blue button that says ‘add new devices?” ….Yes….that is it I replied. Everyone has those moments.
5. Traditionally the last question is not work related. I understand you fly stuff. Tell me all about that, then tell me what your favorite plane is and why?
I have been flying since the age of 14 (it runs in the family). I started out in a J-3 Piper Cub and rapidly moved my way up through the Cessna Caravan and also have time in a B-200 King Air and a BeachJet 400.
Currently, I fly search and rescue for the Civil Air Patrol (CAP), an auxiliary of the U.S. Air Force. We conduct 95% of all homeland search and rescue missions. We operate a beefed-up Cessna 182, and the Gruman GA-8.
Along with flying the big airplanes, I also enjoy designing, building, and flying R/C model aircraft as well. I currently have a collection of 12 airplanes and 4 helicopters. Here’s a video of Timmy flying one of his helicopters in the meeting room at Avast offices in Charlotte.
I would have to say that I have two favorite aircraft; the first one is from WW2 called the Republic P-47 Thunderbolt. It was a formidable fighter with a reputation for taking a pounding and bringing its pilots home safe. The other is my favorite fighter of today – the Boeing F/A-18 Super Hornet. I fell in love with these aircraft the first time I saw them when I was 5 years old at an airshow in Maryland.
Flying is the one thing that I can say without a doubt I am 100% passionate about. I am also a member of the Avast Aviators group on Google Plus. It is an internal group for anyone in Avast that enjoys the splendors of aviation.
Follow Avast on Facebook, Twitter, YouTube, and Google+ where we keep you updated on cybersecurity news every day.
![]()
DSA-3475 postgresql-9.1 – security update
Several vulnerabilities have been found in PostgreSQL-9.1, a SQL
database system.
DSA-3476 postgresql-9.4 – security update
Several vulnerabilities have been found in PostgreSQL-9.4, a SQL
database system.