2990 matches found
Heap-based Buffer Overflow
Description Heap-based Buffer Overflow in rreadle32 Environment radare2 5.6.7 0 @ linux-x86-64 git. commit: 5.6.7 build: 2022-04-1215:06:26 Build export CC=gcc CXX=g++ CFLAGS="-fsanitize=address -static-libasan" CXXFLAGS="-fsanitize=address -static-libasan" LDFLAGS="-fsanitize=address...
global heap buffer overflow in skip_range
✍️ Description When fuzzing vim commit f420ff244 v8.2.4747 with clang 13 and ASan, I discovered a global buffer overflow. Proof of Concept Here is the minified poc bash r 0norm0V:^ How to build bash LD=lld AS=llvm-as AR=llvm-ar RANLIB=llvm-ranlib CC=clang CXX=clang++ CFLAGS="-fsanitize=address"...
Out-of-bounds Read in r_bin_ne_get_entrypoints function
Description Out-of-bounds OOB read vulnerability exists in rbinnegetentrypoints function in Radare2 5.6.7 Version bash radare2 5.6.7 27777 @ linux-x86-64 git.5.6.6 commit: 0c4af43def68ce29f7a74847bb1b7286da155200 build: 2022-04-1008:53:32 Analysis The vulnerability exists due to the invalid type...
heap-buffer-overflow in mrb_vm_exec in mruby/mruby
Affected commit: 3cf291f72224715942beaf8553e42ba8891ab3c6 Proof of Concept ruby= v10 = 0 v15 = "" v16 = srand1337 v20 = protectedmethods.fill|| v20 = Array.instanceeval|| method method privatemethods.zip rescue GC.start removemethod removemethod privatemethods.sample rescue Float v16.v15.v10 resc...
use after free in mrb_vm_exec
While fuzzing mruby I found a use after free in mruby compiled with ASAn. Proof of Concept uaf5.rb rb...
User after free in mrb_vm_exec
While fuzzing mruby I found a use after free in mruby compiled with ASAn. Proof of Concept uaf1.rb rb var1 = -0 var2 = 1.0 var3 = 1 var4 = +0 var3 = methods.groupby || var3 = methods.groupby || var3 = methods.groupby || var3 = methods.groupby || var3 = methods.groupby || var3 = methods.groupby ||...
Heap Buffer Overflow in parseDragons
Description heap buffer overflow in parseDragons function. ASAN report： ================================================================= ==2541037==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000065578 at pc 0x7f45488bde0d bp 0x7ffc08551b50 sp 0x7ffc085512f8 READ of size 4 at...
Heap Buffer Overflow in iterate_chained_fixups
Description heap buffer overflow in iteratechainedfixups function. ASAN report： ================================================================= ==2540511==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000065710 at pc 0x7f5b64ccb878 bp 0x7ffeab141380 sp 0x7ffeab141370 READ of siz...
Use After Free in op_is_set_bp
Description Heap use after free in opissetbp function. ASAN report： ================================================================= ==2367298==ERROR: AddressSanitizer: heap-use-after-free on address 0x6060000481a0 at pc 0x7f580c10da41 bp 0x7ffd53a17ed0 sp 0x7ffd53a17ec0 READ of size 8 at...
Use After Free in r_reg_get_name_idx
Description heap use after free in rreggetnameidx. ASAN report： ================================================================= ==1710816==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020001dff50 at pc 0x7fa7c085d87c bp 0x7ffc21731ac0 sp 0x7ffc21731ab0 READ of size 1 at...
Heap-based Buffer Overflow in mruby/mruby
Description Heap Overflow occurs in mrbfsend. commit : 38b164ace7d6ae1c367883a3d67d7f559783faad Proof of Concept $ echo -ne "c2VuZCJzZW5kIiwic2VuZCIsInNlbmQiLCJzZW5kIiwic2VuZCIsInNlbmQiLCJzZW5kIiwic2Vu ZCIsInNlbmQiLCJzZW5kIiwic2VuZCIsInNlbmQiLCJzZW5kIiwic2VuZCIsInNlbmQiCg==" | base64 -d poc ASAN ...
Heap-based Buffer Overflow in vim/vim
Description Heap overflow occurs in exretab. commit : 414acd342f4a66d930da34d419929985b48bd301 Proof of Concept $ echo -ne "ZnUgUihiLG4pCmxldCBvbGRfdGFic3RvcD0mdGFic3RvcApleGUicmV0ImE6bgppZiBhOm4KZXhl J3NlIHRhYnN0b3A9Jy5vbGRfdGFic3RvcAplbApjYWwgbCgiIixSKCcnLDQpCmNhbCBsKCIiLFIo...
in mruby/mruby
Description OOB read and OOB write in mrbarypush. commit : 903c5f978a2966465d8d5c6dfac55a977d134287 Proof of Concept bash $ echo -ne "bAticjWSUkRPTkxZC2I9e30MWyohMCxtOjAwLG06MF09MXxbKiEwLG0wXQo=" |base64 -d poc ASAN $ ./bin/mruby ./poc AddressSanitizer:DEADLYSIGNAL...
in mruby/mruby
Description There is a NULL Pointer Dereference in ivfree src/variable.c:232:20. This bug has been found on mruby lastest commit hash 00f2b74ab2c1f03084908c815dcd0934f9fc702a on Ubuntu 20.04 for x8664/amd64. Proof of Concept 3.timese=0," =c= y:0,0 0" Steps to reproduce 1- Clone repo and build wit...
in radareorg/radare2
NULL pointer dereference in loadbuffer radare2 suffers from a NULL pointer dereference error in loadbuffer of binxnukernelcache.c Environment date Fri Jan 28 11:03:53 PST 2022 uname -ms Linux x8664 ./radare2 -v radare2 5.5.5 27531 @ linux-x86-64 git.5.5.4 commit:...
CVE-2021-46544
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/lib/x8664-linux-gnu/libasan.so.4+0x59e19. This vulnerability can lead to a Denial of Service DoS...
CVE-2021-46502
Jsish v3.5.0 was discovered to contain a heap-use-after-free via /usr/lib/x8664-linux-gnu/libasan.so.4+0x5166d. This vulnerability can lead to a Denial of Service DoS...
CVE-2021-46333
Moddable SDK v11.5.0 was discovered to contain an invalid memory access vulnerability via the component asanmemmove...