3437 matches found
CVE-2014-4611
CVE-2014-4611 concerns an integer overflow in the LZ4 implementation used in Yann Collet LZ4 prior to r118 and in the Linux kernel’s lz4_decompress.c (linux kernel before 3.15.2) on 32-bit platforms. A crafted Literal Run can trigger improper handling, enabling context-dependent attackers to caus...
CVE-2014-4715
Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect integer overflows, which allows context-dependent attackers to cause a denial of service memory corruption or possibly have unspecified other impact via a crafted...
CVE-2014-4611
Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4uncompress function in lib/lz4/lz4decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service memory corruption o...
The LZO/LZ4 Integer Overflow Summary
Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4uncompress function in lib/lz4/lz4decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service memory corruption o...
CVE-2014-4611
Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4uncompress function in lib/lz4/lz4decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service memory corruption o...
CVE-2014-1379
Graphics Drivers in Apple OS X before 10.9.4 allows attackers to gain privileges or cause a denial of service NULL pointer dereference and system crash via a 32-bit executable file for a crafted application...
MP3Info 0.8.5a - SEH Buffer Overflow Exploit
No description provided by source. Exploit Title: mp3info SEH exploit Date: 18 March 2014 Exploit Author: Ayman Sagy aymansagy at gmail.com Vendor Homepage: http://ibiblio.org/mp3info/ Software Link:...
Linux Kernel < 2.6.36-rc6 pktcdvd Kernel Memory Disclosure
No description provided by source. / cve-2010-3437.c Linux Kernel 2.6.36-rc6 pktcdvd Kernel Memory Disclosure Jon Oberheide [email protected] http://jon.oberheide.org Information: https://bugzilla.redhat.com/showbug.cgi?id=638085 The PKTCTRLCMDSTATUS device ioctl retrieves a pointer to a...
WvTFTPd 0.9 - Remote Root Heap Overflow Exploit
No description provided by source. / wvtftp option name heap overflow remote root exploit infamous42md AT hotpop DOT com exploitation is not exactly straight forward. When we overflow our buffer, we overwrite a pointer that is freed before we get to trigger our overwrite. so we have to restore th...
Oracle Internet Directory 10.1.4 - Remote Preauth DoS Exploit
No description provided by source. !/usr/bin/python Oracle Internet Directory 10.1.4 preauthentication Denial Of Service NOTES: Under 32 bits platforms it crashes immediately. Under 64 bits it may take even hours. Sometimes you need 2 shoots to crash OID completely. The server commonly tolerates...
HTMLDOC 1.9.x-r1629 local .html buffer overflow(win32) exploit
No description provided by source. /HTMLDOC 1.9.x-r1629 local .html buffer overflowwin32 exploit download: http://www.htmldoc.org/software.php?VERSION=1.9.x-r1629&FILE=htmldoc/snapshots/htmldoc-1.9.x-r1629.tar.bz2 header 19 bytes junk 268 bytes EIP register 4 bytes NOP SLEED 15 bytes calc.exe...
Windows Server 2008 R1 Local Denial of Service
No description provided by source. Hi all. Here's a cute little local DoS attack against Windows Server 2008 R1, which will allow any user who can execute unprivileged code to BSoD your server with about three lines of C. I have reported this to Microsoft, but because of the limited scope of the...
VDOLive Player 3.0.2 - Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/872/info VDOLive Player v3.02 has an unchecked buffer that can allow arbitrary code to be executed if a specially-crafted .vdo file is loaded. /====================================================================...
Linux Local Root => 2.6.39 (32-bit & 64-bit) - Mempodipper
No description provided by source. /Exploit code is here: http://git.zx2c4.com/CVE-2012-0056/plain/mempodipper.c Blog post about it is here: http://blog.zx2c4.com/749 Exploit Title: Mempodipper - Linux Local Root for =2.6.39, 32-bit and 64-bit Date: Jan 21, 2012 Author: zx2c4 Tested on: Gentoo,...
RedStorm Ghost Recon Game Engine Remote Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9738/info The Ghost Recon Game Engine has been reported prone to a denial of service vulnerability. When handling text strings, the Ghost Recon Game Engine employs a 32-bit integer string size prefix in order to monitor t...
Linux Kernel 2.6.34+ - CAP_SYS_ADMIN x86 Local Privilege Escalation Exploit
No description provided by source. / Linux Kernel CAPSYSADMIN to root exploit by Dan Rosenberg @djrbliss on twitter Usage: gcc -w caps-to-root.c -o caps-to-root sudo setcap capsysadmin+ep caps-to-root ./caps-to-root This exploit is NOT stable: It only works on 32-bit x86 machines It only works on...
Oracle <= 9i / 10g (extproc) - Local/Remote Command Execution Exploit
No description provided by source. -- -- $Id: raptororaextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptororaextproc.sql - command exec via oracle extproc -- Copyright c 2006 Marco Ivaldi [email protected] -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g --...
[oss-security] CVE request: Another Linux syscall auditing bug
On a 32-bit x86 kernel with syscall auditing enabled, syscall1000 will cause an OOPS. This problem goes at least as far back as Linux 3.11 and appears to be present in Linux 3.15 as well. I suspect that this bug is very old. In order to see this bug, you'll need syscall auditing on auditctl -e 1...
information leak via gnttab_setup_table on ARM
ISSUE DESCRIPTION When initialising an internal data structure on ARM platform Xen was not correctly initialising the memory containing the list of a domain's grant table pages. This list is returned by the GNTTABOPsetuptable subhypercall, leading to an information leak. IMPACT Malicious guest...
LZO -- potential buffer overrun when processing malicious input data
Markus Franz Xaver Johannes Oberhumer reports, in the package's NEWS file: Fixed a potential integer overflow condition in the "safe" decompressor variants which could result in a possible buffer overrun when processing maliciously crafted compressed input data. As this issue only affects 32-bit...