The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image. The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image. Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.ġ0 Ubuntu Linux, Imagemagick, Enterprise Linux Desktop and 7 more Information can be changed soon.6 Debian, Fedoraproject, Mercurial and 3 moreġ4 Debian Linux, Fedora, Mercurial and 11 more
NB: At this moment Mozilla just reserved CVE numbers for these vulnerabilities. NB: This vulnerability have no public CVSS rating so rating can be changed by the time. Vulnerability (8) does not affect users, who have enabled e10s.
Memory safety bugs can be exploited to run arbitrary code. Due to improper validation or origin of incoming events received by Pocket extension, malicious users can fire events, inject code and commands. Improperly sanitized Data from Pocket Server before execution can result in the possibility of HTML injection and access to Pocket’s messaging API. An error occuring while in EnumerateDocuments while adding/removing files can be exploited remotely and possibly cause denial of service. This can performed to obtain sensitive information (for example, usernames embedded in JavaScript code) Malicious users can use a JavaScript Map/Set timing attack to find out whether an atom is used in specific contexts by another compartment or zone. An unknown vulnerability can be exploited remotely via crafted SVG images and use of data: URLs to bypass security restrictions and obtain sensitive information. Use-after-free vulnerability in Editor while performing manipulations with DOM subtrees can be exploited remotely and possibly cause denial of service. Memory corruption while using WebGL functions containing vector constructor with a varying array within libGLES can be exploited remotely and possibly cause denial of service. An unknown vulnerability can be exploited remotely via marquee tags to bypass security restrictions and allow inline JavaScript. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, execute arbitrary code, possibly cause denial of service, gain priveleges or make code injections.īelow is a complete list of vulnerabilities: 
Multiple serious vulnerabilities have been found in Mozilla Firefox ESR.
0 kommentar(er)
