Microsoft Windows Kernel win32k!OffsetChildren - Null Pointer Dereference

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=544 The attached PoC triggers a null pointer vulnerability in OffsetChildren on Windows 7 32-bit. By mapping the null page an attacker can leverage this vulnerability to...

win32k Desktop and Clipboard - Null Pointer Dereference

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=534 The attached PoC triggers a null pointer condition on Windows 7 32-bit, which can potentially be exploited on versions of Windows that allow mapping the null page e.g...

Microsoft Windows Kernel - 'win32k!OffsetChildren' Null Pointer Dereference

Source: https://code.google.com/p/google-security-research/issues/detail?id=544 The attached PoC triggers a null pointer vulnerability in OffsetChildren on Windows 7 32-bit. By mapping the null page an attacker can leverage this vulnerability to write to an arbitrary address. --- Proof of Concept...

Google Plans to End Chrome for 32-bit Linux, Releases Chrome 47

Google announced this week it will end Chrome support for older, 32-bit Linux distributions early next year and will maintain the browser on more popular distributions of the software. Specifically Google plans to stop pushing updates and security fixes to those running Chrome on 32-bit Linux,...

Microsoft Windows - 'ndis.sys' IOCTL 0x170034 (ndis!ndisNsiGetIfNameForIfIndex) Pool Buffer Overflow (MS15-117)

Source: https://code.google.com/p/google-security-research/issues/detail?id=516 The attached testcase crashes Windows 7 32-bit due to a pool buffer overflow in an ioctl handler. Enabling special on ndis.sys netio.sys and ntoskrnl helps to track down the issue, however it will crashes due to a bad...

Chrome - open-vcdiff OOB Read in Browser Process Integer Overflow Exploit

Exploit for linux platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=513 There's an integer overflow issue in sanity checking section lengths when parsing the vcdiff format used in SDCH content encoding. This results in the parser parsing...

wireshark: The TNEF dissector could go into an infinite loop on 32-bit architectures (wnpa-sec-2015-10)

Integer overflow in the dissecttnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service infinite loop via a crafted length field in a packet...

Google Chrome - open-vcdiff Out-of-Bounds Read in Browser Process Integer Overflow

Source: https://code.google.com/p/google-security-research/issues/detail?id=513 There's an integer overflow issue in sanity checking section lengths when parsing the vcdiff format used in SDCH content encoding. This results in the parser parsing outside of sane memory bounds when parsing the...

POP Peeper 4.0.1 - SEH Over-Write Exploit

Exploit for windows platform in category dos / poc ''' Exploit Title: POP Peeper SEH Over-write. Date: 9/14/2015 Exploit Author: UnN0n Software Link: http://www.esumsoft.com/download Version: v4.0.1 Tested on: Windows 7 x8632 BIT DUMP: ''' EAX 00000000 ECX 20203029 EDX 77C5660D ntdll.77C5660D EBX...

Microsoft Windows Kerberos CVE-2015-6095 Local Security Bypass Vulnerability

Description Microsoft Windows is prone to a local security-bypass vulnerability. A local attacker can leverage this issue to bypass certain security restrictions and perform unauthorized actions. Technologies Affected Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 for x64-based...

Latest EMET Bypass Targets WoW64 Windows Subsystem

Backwards compatibility, a necessary evil for Microsoft in its need to support so many legacy applications on Windows, may be its undoing as researchers have found a way to exploit this layer in the operating system to bypass existing mitigations against memory-based exploits. Specifically in thi...

CVE-2014-3716

Xen 4.4.x does not properly check alignment, which allows local users to cause a denial of service crash via an unspecified field in a DTB header in a 32-bit guest kernel...

x86: Uncontrolled creation of large page mappings by PV guests

ISSUE DESCRIPTION The code to validate level 2 page table entries is bypassed when certain conditions are satisfied. This means that a PV guest can create writeable mappings using super page mappings. Such writeable mappings can violate Xen intended invariants for pages which Xen is supposed to...

Microsoft Windows Object Reference CVE-2015-2554 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 for x64-based Systems...

Windows Spy Keylogger - Software to Log Keystrokes in Stealth Mode for 32-bit/64-bit processes on Windows XP/Vista/7/8/10

Windows Spy Keylogger is the free software to help you covertly monitor all activities on your computer. It intercepts everything that is typed on keyboard and stores into one log file which you can view it anytime later. You can track logins , passwords , emails , chats and all other secret thin...

MGASA-2015-0385 Updated pixman packages fix security vulnerabilities

Updated pixman packages fix security vulnerability: The pixman library before 0.32.8 is vulnerable to a buffer overflow which can affect 32-bit systems...

Updated pixman packages fix security vulnerabilities

Updated pixman packages fix security vulnerability: The pixman library before 0.32.8 is vulnerable to a buffer overflow which can affect 32-bit systems...

Out-of-bounds

gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux improperly attempts to use the Cairo library with 32-bit color-depth surface creation followed by 16-bit color-depth surface display, which allows remote attackers to obtain sensitive information from process memory or cause a...

Microsoft Windows Kernel - NtGdiBitBlt Buffer Overflow (MS15-097)

Microsoft Windows Kernel - NtGdiBitBlt Buffer Overflow MS15-097 Source: https://code.google.com/p/google-security-research/issues/detail?id=474 --- The attached PoC triggers a buffer overflow in the NtGdiBitBlt​ system call. It reproduces reliable on Win 7 32-bit with Special Pool enabled on...

Microsoft Windows Kernel - 'NtGdiBitBlt' Buffer Overflow (MS15-097)

Source: https://code.google.com/p/google-security-research/issues/detail?id=474 --- The attached PoC triggers a buffer overflow in the NtGdiBitBlt system call. It reproduces reliable on Win 7 32-bit with Special Pool enabled on win32k.sys --- Proof of Concept:...