New Security Vulnerability in Corrupt Online Images
4497
Within days of the release of the security bulletin, there was proof of concept code available on the web. As the exploit was analyzed by various security groups, it was found that it was similar
283708
Builder.com.au has a new article today about the recent image issue - the PHP code embedded inside the GIF - that's come up on several sites.   The exploit code slipped through the site's defenses with the aid of a legitimate image at the beginning of the file, according to a blog post on the Sans Institutes's Internet Storm Center. [...] Malicious attackers planted PHP coded exploit script within an image file. PHP is often used as a programming language to create dynamic Web sites.   The article reports that, while this exploit hasn't happened much, the occurrences of it's use are growing with victims in a wide range of classifications - from small personal sites out to a certain major image hosting site. This same issue was discussed here on the PHPClasses.org website as well.
133107
Program showing how to use flaw in Windows' handling of graphics files hits the Net--back up your family photos and beware.
387396
Security experts warn that virus writers could be preparing to create havoc using a bug in the way that Windows handles images.
497821
Alternative browser features protection against online scams.
542850
A directory reversal within "flat" extensions could lead to system profile attacks.
430846
In a harbinger of security threats to come, hackers have exploited a newly announced flaw in Microsoft Corp. (MSFT) programs and begun circulating malicious code hidden in images that use the popular JPEG format...
275443
It&#39;s not just the privacy issue of multiple users on a computer and the tool indexing everyone&#39;s contents anymore. According to a Rice University computer scientist, the flaw could allow an attacker to search
297905
Images posted in news groups may install remote control software on vulnerable PCs.
356486
Security flaw involving JPEG files affects at least a dozen Microsoft software applications and operating systems.
112557
Hackers are using porn images posted on Usenet newsgroups to take advantage of the flaw in Microsoft programs regarding JPEGs. An overflow occurs in the GDI+ JPEG decoder from malicious code in the JPEG.
150896
In yet another "security via randomly generated images" kind of article, DevShed has posted their latest - Security Images with PHP and ImageMagick.
506682
After Microsoft announced a flaw (nicknamed the JPEG of Death) in Windows&#39; handling of JPEG images, a Trojan horse that exploits this flaw, has been found looming around pornographic sites.
324468
A vulnerability in Windows XP and other products means JPEG viruses may not remain just a hoary myth.
518501
Security experts say that attacks using image files could bypass established defenses.
411868
A flaw in the way the Firefox and Opera browsers handle an image file could allow an attacker to see what Web sites a person has visited.The problem concerns how the two browsers handle a &quot;.BMP,&quot; or bitmap, image file, according to an advisory written by Gynvael Coldwind of Vexillium.org, who posted a video illustrating the problem.A malicious bitmap file can be created that pulls other information from the browsers&#39; memory. Some of the information that can be captured is random, but at other times could be valuable, the advisory said.&quot;The harvested data contains various information including parts of other Web sites, users&#39; favorites and history, and other information,&quot; Vexillium.org said.Using the &quot;canvas&quot; HTML (Hypertext Markup Language) tag supported by the browsers, an attacker can capture the data. Then, using JavaScript, the information can be sent to a remote server.The flaw could also crash Firefox. The vulnerability affects Firefox 2.0.0.11 and previous versions of that browser as well as the beta version of Opera 9.50.
607068
As per suggestions contained in the FAQ: Herein lies a report of two identified and as-of-yet uncorrected security flaws in Scoop. &nbsp;Enough detail will be provided to assist admins in investigating and correcting the flaws, but it is the author's hope that the details of the flaws will be sufficiently obscured to prevent abuse by the undesirables. Executive summary: Through the exploitation of various unchecked privileged operations, attackers may be able to perform admin-level actions leading to data loss. &nbsp;Additionally, well-intentioned security measures combined with XSS vulnerabilities can be exercised to simulate admin-level action, resulting in data loss.