This module exploits a heap-based buffer overflow in Adobe Flash Player. The bug is triggered by calling BitmapData.copyPixelsToByteArray() with a reference to a ByteArray that has its position property set very large, close to 2^32. This results in an integer overflow in 32-bit arithmetic and allows an attacker to take control of the target machine.

The vulnerability exists within the isObjectModel ActiveX control's RemoveParameter property in Schneider Electric DTM libraries.

Untrusted search path vulnerability in CorelDRAW X7 17.1.0.572, Corel Photo-Paint X7 17.1.0.572, Corel PaintShop Pro X7 17.0.0.199, Corel Painter 2015 14.0.0.728, Corel PDF Fusion 1.12 Build 16/04/2013 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as an .cdr, .cpt, .pspimage, .rif or .pdf file.

Untrusted search path vulnerability in CorelCAD 2014.5 Build 14.4.51 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse FxManagedCommands_3.08_9.tx or TD_Mgd_3.08_9.dll that is located in the same folder as an .dwt file.

Untrusted search path vulnerability in Corel FastFlix 17.0.0.249 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse igfxcmrt32.dll or ipl.dll or MSPStyleLib.dll or uFioUtil.dll or uhDSPlay.dll or uipl.dll or uvipl.dll or VC1DecDll.dll or VC1DecDll_SSE3.dll that is located in the same folder as an .vfp file.

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014.



This update adds support for Internet Explorer 11.

CVE-2014-9390: Git is prone to a vulnerability that may allow attackers to overwrite arbitrary local files.

This module exploits the condition and installs an Agent when a vulnerable GIT client performs a CLONE to the fake repository created.

Untrusted search path vulnerability in Corel VideoStudio Pro X7 17.0.0.249 and Corel FastFlix 17.0.0.249 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse u32ZLib.dll that is located in the same folder as an .vsp or .vfp file.

Untrusted search path vulnerability in Corel PDF Fusion 1.12 Build 16/04/2013 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse quserex.dll that is located in the same folder as an .pdf file.

Untrusted search path vulnerability in Corel Painter 2015 14.0.0.728 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wacommt.dll that is located in the same folder as an .rif file.