The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Apple MacOS X

computer vulnerability bulletin CVE-2016-9933

gd: denial of service via gdImageFillToBorder

Synthesis of the vulnerability

An attacker can generate a fatal error via gdImageFillToBorder() of gd, in order to trigger a denial of service.
Impacted products: Mac OS X, Debian, FortiAnalyzer, FortiAnalyzer Virtual Appliance, FortiGate, FortiGate Virtual Appliance, FortiOS, openSUSE, openSUSE Leap, RHEL, Ubuntu.
Severity: 1/4.
Consequences: denial of service on server, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 22/12/2016.
Identifiers: CERTFR-2017-AVI-237, CVE-2016-9933, DLA-758-1, DSA-3751-1, FG-IR-17-051, HT207483, openSUSE-SU-2016:3228-1, openSUSE-SU-2017:0006-1, openSUSE-SU-2017:0061-1, openSUSE-SU-2017:0081-1, openSUSE-SU-2017:0598-1, RHSA-2018:1296-01, USN-3213-1, VIGILANCE-VUL-21458.

Description of the vulnerability

An attacker can generate a fatal error via gdImageFillToBorder() of gd, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2016-0736 CVE-2016-2161 CVE-2016-8743

Apache httpd: three vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Apache httpd.
Impacted products: Apache httpd, Mac OS X, Debian, BIG-IP Hardware, TMOS, Fedora, HP-UX, Junos Space, openSUSE Leap, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, TrendMicro ServerProtect, Ubuntu.
Severity: 3/4.
Consequences: data reading, data creation/edition, denial of service on service.
Provenance: internet client.
Number of vulnerabilities in this bulletin: 3.
Creation date: 21/12/2016.
Revision date: 22/12/2016.
Identifiers: 1117414, APPLE-SA-2017-09-25-1, CVE-2016-0736, CVE-2016-2161, CVE-2016-8743, DLA-841-1, DLA-841-2, DSA-3796-1, DSA-3796-2, FEDORA-2016-8d9b62c784, FEDORA-2016-d22f50d985, HPESBUX03725, HT207615, HT208144, HT208221, JSA10838, K00373024, openSUSE-SU-2017:0897-1, openSUSE-SU-2017:0903-1, openSUSE-SU-2018:2856-1, RHSA-2017:0906-01, RHSA-2017:1721-01, SSA:2016-358-01, SUSE-SU-2018:2554-1, SUSE-SU-2018:2815-1, USN-3279-1, USN-3373-1, VIGILANCE-VUL-21434.

Description of the vulnerability

Several vulnerabilities were announced in Apache httpd.

An attacker can tamper with encrypted session data, in order to get knowledge of the plain text value. [severity:1/4; CVE-2016-0736]

An attacker can trigger a fatal error in case of use of shared memory, in order to trigger a denial of service. [severity:2/4; CVE-2016-2161]

An attacker can make profit of syntax error recovery to tamper with HTTP responses headers and bodies. [severity:3/4; CVE-2016-8743]
Full Vigil@nce bulletin... (Free trial)

computer vulnerability CVE-2016-9586 CVE-2016-9952 CVE-2016-9953

cURL: three vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of cURL.
Impacted products: SDS, SES, SNS, OpenOffice, Mac OS X, curl, Debian, Unisphere EMC, Fedora, Juniper EX-Series, Junos OS, SRX-Series, openSUSE Leap, Solaris, RHEL, Ubuntu.
Severity: 2/4.
Consequences: client access/rights, data reading.
Provenance: internet server.
Number of vulnerabilities in this bulletin: 3.
Creation date: 21/12/2016.
Identifiers: APPLE-SA-2017-07-19-2, cpuoct2018, CVE-2016-9586, CVE-2016-9952, CVE-2016-9953, DLA-1568-1, DLA-767-1, DSA-2019-114, FEDORA-2016-86d2b5aefb, FEDORA-2016-edbb33ab2e, HT207615, HT207922, JSA10874, openSUSE-SU-2017:1105-1, RHSA-2018:3558-01, STORM-2019-002, USN-3441-1, USN-3441-2, VIGILANCE-VUL-21435.

Description of the vulnerability

Several vulnerabilities were announced in cURL.

An attacker can generate a buffer overflow via float numbers, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2016-9586]

On WinCE platforms, an attacker can tamper with X.501 names in the X.509 certificate validation process, in order to spoof a server. [severity:2/4; CVE-2016-9952]

On WinCE platforms, an attacker can raise a read only buffer overflow in the X.509 certificate validation process, in order to read the server process memory or crash it. [severity:2/4; CVE-2016-9953]
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2016-10009 CVE-2016-10010 CVE-2016-10011

OpenSSH: five vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of OpenSSH.
Impacted products: Mac OS X, Blue Coat CAS, Debian, VNX Operating Environment, VNX Series, BIG-IP Hardware, TMOS, Fedora, FreeBSD, HP-UX, AIX, Juniper EX-Series, Juniper J-Series, Junos OS, Junos Space, Junos Space Network Management Platform, SRX-Series, McAfee Email Gateway, Data ONTAP 7-Mode, OpenSSH, openSUSE Leap, Solaris, pfSense, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: administrator access/rights, privileged access/rights, user access/rights, data reading.
Provenance: intranet client.
Number of vulnerabilities in this bulletin: 5.
Creation date: 19/12/2016.
Identifiers: 1009, 1010, bulletinapr2017, CERTFR-2019-AVI-325, CVE-2016-10009, CVE-2016-10010, CVE-2016-10011, CVE-2016-10012, DLA-1500-1, DLA-1500-2, DSA-2019-131, FEDORA-2017-4767e2991d, FreeBSD-SA-17:01.openssh, HPESBUX03818, HT207615, JSA10880, JSA10940, K24324390, K31440025, K62201745, K64292204, NTAP-20171130-0002, openSUSE-SU-2017:0344-1, openSUSE-SU-2017:0674-1, pfSense-SA-17_03.webgui, RHSA-2017:2029-01, SA144, SSA-181018, SSA:2016-358-02, SUSE-SU-2018:2275-1, SUSE-SU-2018:2685-1, SUSE-SU-2018:3540-1, USN-3538-1, VIGILANCE-VUL-21419.

Description of the vulnerability

Several vulnerabilities were announced in OpenSSH.

An attacker can bypass security features via ssh-agent, in order to escalate his privileges. [severity:2/4; CVE-2016-10009]

An attacker can bypass security features via Unix Domain Sockets, in order to escalate his privileges. [severity:2/4; CVE-2016-10010]

An attacker can bypass security features via Privilege-separated Child realloc(), in order to obtain sensitive information. [severity:1/4; CVE-2016-10011]

An attacker can generate a buffer overflow via Pre-authentication Compression, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2016-10012]

An attacker can bypass security features via AllowUser/DenyUsers Address Ranges, in order to escalate his privileges. [severity:2/4]
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2016-1777 CVE-2016-1823 CVE-2016-4688

Apple MacOS: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Apple MacOS.
Impacted products: Mac OS X.
Severity: 3/4.
Consequences: administrator access/rights, privileged access/rights, data reading, data creation/edition, denial of service on server, denial of service on service, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 46.
Creation date: 14/12/2016.
Revision date: 16/12/2016.
Identifiers: 926, 930, 941, 954, 959, 965, 974, 976, 977, CERTFR-2016-AVI-411, CVE-2016-1777, CVE-2016-1823, CVE-2016-4688, CVE-2016-4691, CVE-2016-4693, CVE-2016-6304, CVE-2016-7588, CVE-2016-7591, CVE-2016-7594, CVE-2016-7595, CVE-2016-7596, CVE-2016-7600, CVE-2016-7602, CVE-2016-7603, CVE-2016-7604, CVE-2016-7605, CVE-2016-7606, CVE-2016-7607, CVE-2016-7608, CVE-2016-7609, CVE-2016-7612, CVE-2016-7615, CVE-2016-7616, CVE-2016-7617, CVE-2016-7618, CVE-2016-7619, CVE-2016-7620, CVE-2016-7621, CVE-2016-7622, CVE-2016-7624, CVE-2016-7625, CVE-2016-7627, CVE-2016-7628, CVE-2016-7629, CVE-2016-7633, CVE-2016-7636, CVE-2016-7637, CVE-2016-7643, CVE-2016-7644, CVE-2016-7655, CVE-2016-7657, CVE-2016-7658, CVE-2016-7659, CVE-2016-7660, CVE-2016-7661, CVE-2016-7662, CVE-2016-7663, HT207423, VIGILANCE-VUL-21377, ZDI-16-633, ZDI-16-643, ZDI-16-644.

Description of the vulnerability

Several vulnerabilities were announced in Apple MacOS.

An attacker can force a NULL pointer to be dereferenced via AppleGraphicsPowerManagement(), in order to trigger a denial of service. [severity:3/4; CVE-2016-7609, ZDI-16-643]

An attacker may change data modified from a mobile device. [severity:2/4; CVE-2016-7628]

An attacker can generate a memory corruption via audio files, in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2016-7658]

An attacker can generate a memory corruption via audio files, in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2016-7659]

An attacker can use a vulnerability in the Bluetooth stack, in order to run code with kernel privileges. [severity:3/4; CVE-2016-7596]

An attacker can force a NULL pointer to be dereferenced via Bluetooth, in order to trigger a denial of service. [severity:2/4; CVE-2016-7605]

An attacker can generate a memory corruption via Bluetooth, in order to trigger a denial of service, and possibly to run code with kernel privileges. [severity:3/4; CVE-2016-7617, ZDI-16-644]

An attacker can force a NULL pointer to be dereferenced via CoreCapture, in order to trigger a denial of service. [severity:2/4; CVE-2016-7604]

An attacker can generate a buffer overflow via CoreFoundation, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2016-7663]

An attacker can force a NULL pointer to be dereferenced via a font, in order to trigger a denial of service. [severity:2/4; CVE-2016-7627]

An attacker can generate a memory corruption via mediaserver, in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2016-7655]

An attacker can generate a memory corruption via a mp4 file, in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2016-7588]

An attacker can force a NULL pointer to be dereferenced via CoreStorage, in order to trigger a denial of service. [severity:2/4; CVE-2016-7603]

An attacker can generate memory corruptions via font files, in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2016-7595]

An attacker can force the usage of a freed memory area via Directory Services, in order to trigger a denial of service, and possibly to run code with administrator privileges. [severity:3/4; CVE-2016-7633]

An attacker can generate a memory corruption via Disk Images, in order to trigger a denial of service, and possibly to run code with kernel privileges. [severity:3/4; CVE-2016-7616, ZDI-16-633]

An attacker can generate a buffer overflow via FontParser, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2016-4691]

An attacker can generate a buffer overflow via FontParser, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2016-4688]

An attacker can generate a buffer overflow via a gcx file, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2016-7618]

An attacker can generate a memory corruption via a gcx file, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2016-7622]

An attacker can generate a memory corruption via ICU, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2016-7594]

An attacker can read a memory fragment via ImageIO, in order to obtain sensitive information. [severity:1/4; CVE-2016-7643]

An attacker can generate a memory corruption via Intel, in order to trigger a denial of service, and possibly to run code with the kernel privileges. [severity:3/4; CVE-2016-7602]

An attacker can read a kernel memory fragment via IOFireWireFamily, in order to obtain sensitive information. [severity:1/4; CVE-2016-7608]

An attacker can bypass security features via IOAcceleratorFamily, in order to obtain sensitive information. [severity:1/4; CVE-2016-7624]

An attacker can generate a memory corruption via IOHIDFamily, in order to trigger a denial of service, and possibly to run code with kernel privileges. [severity:3/4; CVE-2016-1823]

An attacker can force the usage of a freed memory area via IOHIDFamily, in order to trigger a denial of service, and possibly to run code with kernel privileges. [severity:3/4; CVE-2016-7591]

An attacker can read a kernel memory fragment via IOHIDFamily, in order to obtain sensitive information. [severity:1/4; CVE-2016-7657]

An attacker can bypass security features via IOKit, in order to obtain sensitive information. [severity:1/4; CVE-2016-7625]

An attacker can bypass security features via IOSurface, in order to obtain sensitive information. [severity:1/4; CVE-2016-7620]

An attacker can use a vulnerability, in order to run code with kernel privileges. [severity:3/4; 930, CVE-2016-7606, CVE-2016-7612]

An attacker can read a memory fragment via Kernel, in order to obtain sensitive information. [severity:1/4; CVE-2016-7607]

An attacker can trigger a fatal error via Kernel, in order to trigger a denial of service. [severity:2/4; CVE-2016-7615]

An attacker can force the usage of a freed memory area via Kernel, in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2016-7621]

An attacker can bypass security features via Kernel, in order to escalate his privileges. [severity:3/4; CVE-2016-7637]

An attacker can force the usage of a freed memory area via Kernel, in order to trigger a denial of service, and possibly to run code with kernel privileges. [severity:3/4; 965, CVE-2016-7644]

An attacker can bypass security features via kext tools, in order to escalate his privileges. [severity:3/4; CVE-2016-7629]

An attacker can use an archive with symbolic links to corrupt files. [severity:2/4; CVE-2016-7619]

An attacker can send malicious OCSP packets to a LibreSSL based application, in order to trigger a denial of service. [severity:2/4; CVE-2016-6304]

OpenLDAP may use weak encryption. [severity:1/4; CVE-2016-1777]

An attacker can bypass security features via OpenPAM, in order to escalate his privileges. [severity:2/4; CVE-2016-7600]

An attacker can bypass security features via Power Management, in order to escalate his privileges. [severity:3/4; CVE-2016-7661]

The system may use Triple DES. [severity:1/4; CVE-2016-4693]

An attacker can send malicious OCSP packets, in order to trigger a denial of service. [severity:2/4; CVE-2016-7636]

X.509 certificate validation is incomplete. [severity:3/4; CVE-2016-7662]

An attacker can bypass security features via syslog, in order to escalate his privileges. [severity:3/4; CVE-2016-7660]
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2016-9935 CVE-2016-9936

PHP: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of PHP.
Impacted products: Mac OS X, Debian, openSUSE, openSUSE Leap, Solaris, PHP, RHEL, Slackware, Ubuntu.
Severity: 2/4.
Consequences: user access/rights, data reading, denial of service on service.
Provenance: document.
Number of vulnerabilities in this bulletin: 7.
Creation date: 08/12/2016.
Identifiers: 61183, 71494, 72978, 73087, 73392, 73631, bulletinjul2017, CVE-2016-9935, CVE-2016-9936, DLA-818-1, DSA-3737-1, HT207615, openSUSE-SU-2016:3239-1, openSUSE-SU-2017:0061-1, openSUSE-SU-2017:0081-1, openSUSE-SU-2017:0598-1, RHSA-2018:1296-01, SSA:2016-347-03, USN-3196-1, USN-3211-1, USN-3211-2, VIGILANCE-VUL-21327.

Description of the vulnerability

Several vulnerabilities were announced in PHP.

An attacker can create a memory leak via Spl Hash, in order to trigger a denial of service. [severity:1/4]

An attacker can generate an integer overflow via Calendar, in order to trigger a denial of service, and possibly to run code. [severity:2/4]

An attacker can force the usage of a freed memory area via Zend Allocator Management, in order to trigger a denial of service, and possibly to run code. [severity:2/4; 73392]

An attacker can generate a memory corruption via PDO_Firebird bindParam, in order to trigger a denial of service, and possibly to run code. [severity:2/4; 61183, 71494, 73087]

An attacker can create a memory leak via wddx, in order to trigger a denial of service. [severity:1/4; 73631, CVE-2016-9935]

An unknown vulnerability was announced via wddx. [severity:2/4; 73631, CVE-2016-9935]

An attacker can force the usage of a freed memory area via unserialize(), in order to trigger a denial of service, and possibly to run code. [severity:2/4; 72978, CVE-2016-9936]
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2016-8740

Apache httpd: denial of service via HTTP/2

Synthesis of the vulnerability

An attacker can generate an overload via the HTTP/2 experimental module of Apache httpd, in order to trigger a denial of service.
Impacted products: Apache httpd, Mac OS X, Fedora, HP-UX, openSUSE Leap, Slackware, TrendMicro ServerProtect.
Severity: 2/4.
Consequences: denial of service on server, denial of service on service.
Provenance: internet client.
Creation date: 05/12/2016.
Identifiers: 1117414, APPLE-SA-2017-09-25-1, CVE-2016-8740, FEDORA-2016-260d22944d, FEDORA-2016-b39fedec11, HPESBUX03725, HT207615, HT208144, HT208221, openSUSE-SU-2017:0297-1, SSA:2016-358-01, VIGILANCE-VUL-21263.

Description of the vulnerability

An attacker can generate an overload via the HTTP/2 experimental module of Apache httpd, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2016-9840 CVE-2016-9841 CVE-2016-9842

zlib: five vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of zlib.
Impacted products: iOS by Apple, iPhone, Mac OS X, Debian, Fedora, AIX, DB2 UDB, Domino, MQSeries, Notes, Security Directory Server, SPSS Statistics, Kubernetes, MariaDB ~ precise, MySQL Community, MySQL Enterprise, Java OpenJDK, openSUSE, openSUSE Leap, Java Oracle, Oracle OIT, Solaris, Percona Server, Python, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Nessus, zlib.
Severity: 2/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 5.
Creation date: 05/12/2016.
Identifiers: 1997877, 2001520, 2003212, 2004735, 2005160, 2005255, 2006014, 2006017, 2007242, 2010282, 2011648, 2014202, APPLE-SA-2017-09-19-1, APPLE-SA-2017-09-25-1, APPLE-SA-2017-09-25-4, bulletinapr2017, bulletinoct2018, CERTFR-2018-AVI-288, cpujul2018, cpuoct2017, cpuoct2018, CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843, DLA-1725-1, FEDORA-2018-242f6c1a41, FEDORA-2018-55b875c1ac, HT208144, ibm10718843, openSUSE-SU-2016:3202-1, openSUSE-SU-2017:0077-1, openSUSE-SU-2017:0080-1, openSUSE-SU-2017:2998-1, openSUSE-SU-2018:0042-1, openSUSE-SU-2018:3478-1, openSUSE-SU-2019:0327-1, RHSA-2017:1220-01, RHSA-2017:1221-01, RHSA-2017:1222-01, RHSA-2017:2999-01, RHSA-2017:3046-01, RHSA-2017:3047-01, SSA:2018-309-01, SUSE-SU-2017:1384-1, SUSE-SU-2017:1386-1, SUSE-SU-2017:1387-1, SUSE-SU-2017:1444-1, SUSE-SU-2017:2989-1, SUSE-SU-2017:3369-1, SUSE-SU-2017:3411-1, SUSE-SU-2017:3440-1, SUSE-SU-2017:3455-1, SUSE-SU-2018:0005-1, SUSE-SU-2018:3542-1, SUSE-SU-2018:3972-1, SUSE-SU-2018:4211-1, SUSE-SU-2019:0119-1, SUSE-SU-2019:0555-1, SUSE-SU-2019:2048-1, TNS-2018-08, VIGILANCE-VUL-21262.

Description of the vulnerability

Several vulnerabilities were announced in zlib.

An attacker can generate a memory corruption via Deflate External Linkage, in order to trigger a denial of service, and possibly to run code. [severity:2/4]

A pointer error may have a consequence. [severity:1/4]

An attacker can force a read at an invalid address via inftrees.c, in order to trigger a denial of service, or to obtain sensitive information. [severity:1/4; CVE-2016-9840, CVE-2016-9841]

A negative number shift is undefined. [severity:1/4; CVE-2016-9842]

An attacker can force a read at an invalid address via Big-endian Pointer, in order to trigger a denial of service, or to obtain sensitive information. [severity:1/4; CVE-2016-9843]
Full Vigil@nce bulletin... (Free trial)

computer vulnerability CVE-2016-9533 CVE-2016-9534 CVE-2016-9535

LibTIFF: eight vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of LibTIFF.
Impacted products: Mac OS X, Debian, BIG-IP Hardware, TMOS, LibTIFF, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 3/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 8.
Creation date: 23/11/2016.
Identifiers: CVE-2016-9533, CVE-2016-9534, CVE-2016-9535, CVE-2016-9536, CVE-2016-9537, CVE-2016-9538, CVE-2016-9539, CVE-2016-9540, DLA-795-1, DLA-880-1, DSA-3762-1, DSA-3844-1, HT207615, K34527393, RHSA-2017:0225-01, SUSE-SU-2018:1835-1, USN-3212-1, USN-3212-2, USN-3212-3, USN-3212-4, VIGILANCE-VUL-21195.

Description of the vulnerability

Several vulnerabilities were announced in LibTIFF.

An attacker can generate a buffer overflow via tif_pixarlog.c, in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2016-9533]

An attacker can generate a buffer overflow via TIFFFlushData1(), in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2016-9534]

An attacker can generate a buffer overflow via YCbCr With Subsampling, in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2016-9535]

An attacker can generate a buffer overflow via t2p_process_jpeg_strip(), in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2016-9536]

An attacker can generate a buffer overflow via tools/tiffcrop.c, in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2016-9537]

An attacker can force a read at an invalid address via readContigStripsIntoBuffer(), in order to trigger a denial of service, or to obtain sensitive information. [severity:2/4; CVE-2016-9538]

An attacker can force a read at an invalid address via readContigTilesIntoBuffer(), in order to trigger a denial of service, or to obtain sensitive information. [severity:2/4; CVE-2016-9539]

An attacker can generate a buffer overflow via cpStripToTile(), in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2016-9540]
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2016-1248

vim: code execution via Modeline

Synthesis of the vulnerability

An attacker can use a vulnerability via Modeline of vim, in order to run code.
Impacted products: Mac OS X, Debian, BIG-IP Hardware, TMOS, openSUSE, openSUSE Leap, Solaris, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: user access/rights.
Provenance: document.
Creation date: 23/11/2016.
Identifiers: bulletinapr2017, CVE-2016-1248, DLA-718-1, DSA-3722-1, HT207483, K22183127, openSUSE-SU-2016:2992-1, openSUSE-SU-2016:2993-1, RHSA-2016:2972-01, SUSE-SU-2016:2938-1, SUSE-SU-2016:2942-1, USN-3139-1, VIGILANCE-VUL-21191.

Description of the vulnerability

An attacker can use a vulnerability via Modeline of vim, in order to run code.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Apple MacOS X: