ImageMagick: memory leak in psd handling

Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.

ImageMagick: incorrect boundary checks in DecodePSDPixels

The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors.

ImageMagick: out of bound issue in rle file

The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file.

ImageMagick: crash due to corrupted dib file

The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file.

ImageMagick: overflow in rle file

Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact.

ImageMagick: incorrect handling of "previous" image in the JNG decoder

The jng decoder in ImageMagick 6.8.9.9 allows remote attackers to have an unspecified impact.

ImageMagick: memory leak in quantum management

Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption).

ImageMagick: crash in png coder

The png coder in ImageMagick allows remote attackers to cause a denial of service (crash).

ImageMagick: incorrect thread limit logic

Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption).

ImageMagick: crash when parsing resource block

ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash).

ImageMagick: memory leak in rle file handling

Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file.

tcpdump: denial of service in print-wb.c

print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash).

ntp: ntp-keygen may generate non-random symmetric keys on big-endian systems

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

jasper: integer overflow in jas_image_cmpt_create()

Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.

jasper: use-after-free and double-free flaws in mif_process_cmpt()

Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.

Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.

ImageMagick: Arbitrary module loading due to not escaping relative path

Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors.

Mozilla: Out-of-bounds write in Cairo (MFSA 2014-41)

The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element.

Mozilla: Buffer overflow in Web Audio Speex resampler (MFSA 2014-53)

Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate.

castor: XML External Entity (XXE) attacks via a crafted XML document

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.