Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.
The Content Security Policy (CSP) implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient style-src restrictions.
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
It was discovered that libtasn1 library function asn1getbitder() could incorrectly report negative bit length of the value read from ASN.1 input. This could possibly lead to an out of bounds access in an application using libtasn1, for example in case if application tried to terminate read value with NUL byte.
The following upstream commit corrects the issue and causes the function to report error rather than return negative length value: http://git.savannah.gnu.org/cgit/libtasn1.git/commit/?id=1c3ccb3e040bf13e342ee60bc23b21b97b11923f
Multiple integer overflows in the binary-search implementation in SpiderMonkey in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 might allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JavaScript code.
Heap-based buffer overflow in the fcgidheaderbucketread function in fcgidbucket.c in the modfcgid module before 2.3.9 for the Apache HTTP Server allows remote attackers to have an unspecified impact via unknown vectors.
A buffer overflow flaw affecting ImageMagick versions prior to 6.8.8-5 when handling PSD images was reported:
http://secunia.com/advisories/56844/
Diffing ImageMagick-6.8.7/coders/psd.c and ImageMagick-6.8.8/coders/psd.c, it looks like the flaw may be FormatLocaleString() writing the amount of 6 long integers (approximately 48 bytes) into a buffer (layername) that is only 4 bytes:
"" @@ -1224,7 +1224,7 @@ Allocate layered image. / layerinfo[i].image=CloneImage(image,layerinfo[i].page.width, - layerinfo[i].page.height == ~0U ? 1 : layerinfo[i].page.height, + layerinfo[i].page.height == ~0UL ? 1 : layerinfo[i].page.height, MagickFalse,&image->exception); if (layerinfo[i].image == (Image ) NULL) { @@ -2112,9 +2112,6 @@ StringInfo bimprofile; - unsigned char - layername[4]; - / Open image file. / @@ -2372,12 +2369,15 @@ property=(const char ) GetImageProperty(nextimage,"label"); if (property == (const char ) NULL) { + char + layername[MaxTextExtent]; + (void) WriteBlobMSBLong(image,16); (void) WriteBlobMSBLong(image,0); (void) WriteBlobMSBLong(image,0); - (void) FormatLocaleString((char ) layername,MaxTextExtent, - "L%06ld",(long) layercount++); - WritePascalString( image, (char)layername, 4 ); + (void) FormatLocaleString(layername,MaxTextExtent,"L%06ld",(long) + layercount++); + WritePascalString(image,layername,4); } else {
""
CVE request: http://www.openwall.com/lists/oss-security/2014/02/12/2
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUSSTARTPACKET set and then a crafted packet with TXSTATUSDEVICEOWNS set.