CVE-2017-15756

IrfanView 4.50 (64-bit) with the BabaCAD4Image plugin 1.3 is affected by a vulnerability in the BabaCAD4Image plugin when handling crafted .dwg files. The issue is described as a buffer/WRITE address control fault starting at BabaCAD4Image!ShowPlugInOptions+0x4d7c4, enabling arbitrary code execut...

CVE-2017-15766

CVE-2017-15766 concerns IrfanView 4.50 (64‑bit) when using the BabaCAD4Image plugin v1.3. Multiple connected sources describe a buffer/related overflow in the BabaCAD4Image component triggered by crafted .dwg files, enabling denial of service and potentially other unspecified impact on the vulner...

CVE-2017-15769

Summary: CVE-2017-15769 affects IrfanView 4.50 (64-bit). A crafted .dds file can cause a denial of service and may have unspecified other impact, linked to a Read Access Violation starting at FORMATS!ReadBLP_W. Concrete exploitation details are not provided in the documents, but multiple sources ...

CVE-2017-15768

IrfanView version 4.50 - 64bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif file, related to "Data from Faulting Address controls Branch Selection starting at image000007f742060000+0x0000000000094113."...

CVE-2017-15741

CVE-2017-15741 affects IrfanView 4.50 (64‑bit) with the CADImage plugin 12.0.0.5 and can be triggered by a crafted .dwg file to cause a denial of service and possibly other impacts, related to a stack corruption at CADIMAGE+0x3d2378. Connected sources (SUSE, CNVD, NVD, OpenVAS context) confirm th...

CVE-2017-15765

IrfanView 4.50 (64‑bit) with CADImage plugin 12.0.0.5 is affected by CVE-2017-15765. The issue arises when processing a crafted .dwg file, with the faulting address data used as arguments in a subsequent CADIMAGE function call (CADIMAGE+0x00000000003e9462), leading to a denial of service and pote...

CVE-2017-15741

IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Possible Stack Corruption starting at CADIMAGE+0x00000000003d2378."...

CVE-2017-15753

CVE-2017-15753 affects IrfanView 4.50 (64-bit) with the BabaCAD4Image plugin v1.3. A buffer overflow in BabaCAD4Image (ShowPlugInOptions+0x29c2) can be triggered by a crafted .dwg file, leading to DoS and potentially other impact. Affected product: IrfanView with BabaCAD4Image plugin 1.3; root ca...

Easy DVD Creator 2.5.11 - Buffer Overflow (SEH) Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title: Easy DVD Creator 2.5.11 - Buffer Overflow Windows 10 64bit, SEH Date: 26-08-2017 Exploit Author: tr0ubl3m4k3r Vulnerable Software: Easy DVD Creator Vendor Homepage: http://www.divxtodvd.net/ Version: 2.5.11...

Easy DVD Creator 2.5.11 - Local Buffer Overflow (SEH)

!/usr/bin/python Exploit Title: Easy DVD Creator 2.5.11 - Buffer Overflow Windows 10 64bit, SEH Date: 26-08-2017 Exploit Author: tr0ubl3m4k3r Vulnerable Software: Easy DVD Creator Vendor Homepage: http://www.divxtodvd.net/ Version: 2.5.11 Software Link: http://www.divxtodvd.net/easydvdcreator.exe...

AVET - AntiVirus Evasion Tool

AVET is an AntiVirus Evasion Tool, which was developed for making life easier for pentesters and for experimenting with antivirus evasion techniques. In version 1.1 lot of stuff was introduced, for a complete overview have a look at the CHANGELOG file. Now 64bit payloads can also be used, for...

Code Injection through DLL Sideloading in 64bit Oracle Java(CVE-2017-3511)

This blog post is about a DLL sideloading vulnerability in the 64bit Windows version of Oracle Java. It allows any local user to inject code in Java processes of other users. At the time of writing it has been verified with the latest stable 64bit Java version 1.8.0101 on both a fully patched...

Oracle GoldenGate 12.1.2.0.0 - Unauthenticated Remote Code Execution Exploit

Exploit for multiple platform in category remote exploits !/usr/bin/env python Sources: https://silentsignal.hu/docs/S2OracleGoldenGateGOLDENSHOWER.py https://blog.silentsignal.eu/2017/05/08/fools-of-golden-gate/ GOLDENSHOWER - Oracle GoldenGate unauthenticated RCE by Silent Signal Tested with:...

Xen 64bit PV Guest - pagetable use-after-type-change Breakout Vulnerability

Exploit for linux platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1231 This is a bug in Xen that permits an attacker with control over the kernel of a 64bit X86 PV guest to write arbitrary entries into a live top-level pagetable. To prevent PV...

Oracle GoldenGate 12.1.2.0.0 - Remote Code Execution

!/usr/bin/env python Sources: https://silentsignal.hu/docs/S2OracleGoldenGateGOLDENSHOWER.py https://blog.silentsignal.eu/2017/05/08/fools-of-golden-gate/ GOLDENSHOWER - Oracle GoldenGate unauthenticated RCE by Silent Signal Tested with: Version 12.1.2.0.0 17185003...

Xen 64bit PV Guest - pagetable use-after-type-change Breakout

Xen 64bit PV Guest - pagetable use-after-type-change Breakout Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1231 This is a bug in Xen that permits an attacker with control over the kernel of a 64bit X86 PV guest to write arbitrary entries into a live top-level pagetable. To...

x86: 64bit PV guest breakout via pagetable use-after-mode-change

ISSUE DESCRIPTION 64-bit PV guests typically use separate root page tables for their kernel and user modes. Hypercalls are accessible to guest kernel context only, which certain hypercall handlers make assumptions on. The IRET hypercall replacing the identically name CPU instruction is used by...

ASUS PCE-AC56 WLAN Card Utilities (PCAUSA Rawether Windows 10 x64) - Local Privilege Escalation Expl

Exploit for windows platform in category local exploits Rawether for Windows is a framework that facilitates communication between an application and the NDIS miniport driver. It’s produced by a company named Printing Communications Assoc., Inc. PCAUSA, which seems to be no longer operating...

ASUS PCE-AC56 WLAN Card Utilities (PCAUSA Rawether Windows 10 x64) - Local Privilege Escalation

ASUS PCE-AC56 WLAN Card Utilities PCAUSA Rawether Windows 10 x64 - Local Privilege Escalation. Local exploit for Winx86-64 platform Rawether for Windows is a framework that facilitates communication between an application and the NDIS miniport driver. It’s produced by a company named Printing...

Updated shadow-utils packages fix security vulnerabilities

It was found that shadow-utils-4.2.1 had a potentially unsafe use of getlogin with the concern that the utmp entry might have a spoofed username associated with a correct uid CVE-2016-6251. It was found that shadow-utils-4.2.1 had an incorrect integer handling problem where it looks like the int...