Vulnerability Spotlight: Pharos Vulnerabilities
Summary: Cisco Talos disclosed three code execution vulnerabilities and one denial of service vulnerability in the psnotifyd application of the Pharos PopUp printer client version 9.0, tracked as TALOS-2017-0280 through TALOS-2017-0283 and CVE-2017-2785 through CVE-2017-2786. The flaws include buffer overflows in the DecodeString and DecodeBinary functions triggered by crafted packets with attacker-controlled length values, a memcpy out-of-bounds write in the BlobData function, and an invalid pointer dereference in DecodeString that causes a denial of service.
Key Takeaway: The affected service runs with root privileges and accepts network connections, so a single crafted packet sent to a victim's machine can yield remote code execution at the highest privilege level.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-2785CVE-2017-2786CVE-2017-2787CVE-2017-2788
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026