SEC Consult SA-20170407-0 :: Server-Side Request Forgery in MyBB forum

Posted by SEC Consult Vulnerability Lab on Apr 07

SEC Consult Vulnerability Lab Security Advisory < 20170407-0 >
=======================================================================
title: Server Side Request Forgery (SSRF) Vulnerability
product: MyBB
vulnerable version: 1.8.10
fixed version: 1.8.11
CVE number: CVE-2017-7566
impact: Medium
homepage: https://mybb.com/
found: 2017-03-03
by:…

CVE-2017-7578

Multiple heap-based buffer overflows in parser.c in libming 0.4.7 allow remote attackers to cause a denial of service (listswf application crash) or possibly have unspecified other impact via a crafted SWF file. NOTE: this issue exists because of an incomplete fix for CVE-2016-9831.

Software and Security Information