582 matches found
CVE-2016-8617
CVE-2016-8617 affects libcurl’s base64 encoding path. The output buffer is allocated as insize * 4 / 3 + 4 without checks, which on 32‑bit user-space systems can wrap when input size reaches ≥1 GB. This under-allocated buffer may be overflowed as the full encoded data is written. Systems with 64‑...
CVE-2016-8617
The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via CURLOPTUSERNAME...
Polaris Office 2017 8.1 Remote Code Execution Exploit
Polaris Office 2017 version 8.1 allows attackers to execute arbitrary code via a trojan horse "puiframeworkproresenu.dll" file in the current working directory, due to a search order flaw vulnerability. + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...
Design/Logic Flaw
curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable...
CVE-2017-13288
In writeToParcel and readFromParcel of PeriodicAdvertisingReport.java, there is a permission bypass due to a 64/32bit int mismatch. This could lead to a local escalation of privilege where the user can start an activity with system privileges, with no additional execution privileges needed. User...
Transmission - Integer Overflows Parsing Torrent Files
Transmission - Integer Overflows Parsing Torrent Files I took a look at torrent file parsing in libtransmission, there are a few integer overflows because the trnew/trnew0 allocation wrappers don't handle overflow. define trnewstructtype, nstructs \ structtype trmalloc sizeof structtype...
Updated kernel packages fix security vulnerabilities
This kernel update is based on the upstream 4.14.20 and adds KPTI mitigation for Meltdown CVE-2017-5754 on 32bit x86. Arm platorm has now also addedmitigations for Meltdown CVE-2017-5754 and Spectre, variant 2 CVE-2017-5715. For other fixes in this update, read the referenced changelogs...
PT-2018-17528 · Sangoma · Freepbx
Name of the Vulnerable Software and Affected Versions: FreePBX versions 10.13.66-32bit and 14.0.1.24 SNG7-PBX-64bit-1712-2 Description: The issue allows post-authentication SQL injection via the order parameter. It is noted that the vendor disputes this issue, stating it is intentional for users ...
OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0010) (Meltdown) (Spectre)
The remote OracleVM system is missing necessary patches to address critical security updates : - x86/pti/efi: broken conversion from efi to kernel page table Pavel Tatashin Orabug: 27363926 Orabug: 27352353 CVE-2017-5754 - x86/spec: Always set IBRS to guest value on VMENTER and host on VMEXIT red...
FreePBX SQL Injection Vulnerability
FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. A SQL injection vulnerability exists in FreePBX version 10.13.66-32bit. The vulnerability can be exploited by a...
CVE-2017-15932
In radare2 2.0.1, an integer exception negative number leading to an invalid memory access exists in storeversioninfognuverdef in libr/bin/format/elf/elf.c via crafted ELF files when parsing the ELF version on 32bit systems...
CVE-2017-15931
In radare2 2.0.1, an integer exception negative number leading to an invalid memory access exists in storeversioninfognuverneed in libr/bin/format/elf/elf.c via crafted ELF files on 32bit systems...
CVE-2017-15931
In radare2 2.0.1, an integer exception negative number leading to an invalid memory access exists in storeversioninfognuverneed in libr/bin/format/elf/elf.c via crafted ELF files on 32bit systems...
CVE-2017-15931
In radare2 2.0.1, an integer exception negative number leading to an invalid memory access exists in storeversioninfognuverneed in libr/bin/format/elf/elf.c via crafted ELF files on 32bit systems...
CVE-2017-15931
In radare2 2.0.1, an integer exception negative number leading to an invalid memory access exists in storeversioninfognuverneed in libr/bin/format/elf/elf.c via crafted ELF files on 32bit systems...
CVE-2017-15931
In radare2 2.0.1, an integer exception negative number leading to an invalid memory access exists in storeversioninfognuverneed in libr/bin/format/elf/elf.c via crafted ELF files on 32bit systems...
Rekall v1.7 - Forensic and Incident Response Framework
The Rekall Framework is a completely open collection of tools, implemented in Python under the Apache and GNU General Public License, for the extraction and analysis of digital artifacts computer systems. The Rekall distribution is available from: http://www.rekall-forensic.com/ Rekall should run...
Watchdog Development Anti-Malware / Online Security Pro - NULL Pointer Dereference Exploit
Exploit for windows platform in category dos / poc / Exploit Title - Watchdog Development Anti-Malware/Online Security Pro Null Pointer Dereference Date - 26th October 2017 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - https://www.watchdogdevelopment.com/ Tested Version - 2.74.186.150...
Watchdog Development Anti-Malware / Online Security Pro - NULL Pointer Dereference
/ Exploit Title - Watchdog Development Anti-Malware/Online Security Pro Null Pointer Dereference Date - 26th October 2017 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - https://www.watchdogdevelopment.com/ Tested Version - 2.74.186.150 Driver Version - 2.21.63 - zam32.sys Tested on OS ...
CVE-2017-15251
IrfanView version 4.44 32bit with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to "Data from Faulting Address controls Code Flow starting at PDF!xmlParserInputRead+0x00000000000e7326."...