DEBIAN-CVE-2016-4330

In the HDF5 1.8.16 library's failure to check if the number of dimensions for an array read from the file is within the bounds of the space allocated for it, a heap-based buffer overflow will occur, potentially leading to arbitrary code execution...

NVIDIA Driver - Missing Bounds Check in Escape 0x100009a Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=942 The DxgkDdiEscape handler for escape 0x100009a lacks proper bounds checks: case 0x100009A: ... size0 = escapedata-size1; ... size1 = 2 - escapedata-unknown size2; ... totalsize...

NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5 Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944 The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks: ... if gsavedsize escape-size = gsavedsize; if unsigned intgsavedsize 0 do v5 = v2++; escape-datav5 = globalarrayv5...

NVIDIA Driver - Incorrect Bounds Check in Escape 0x70001b2 Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=940 The DxgkDdiEscape handler for 0x70001b2 doesn't do proper bounds checks for its variable size input. void sub8C4304... ... // escape-size is controlled by the user. if...

NVIDIA Driver - Escape 0x100010b Missing Bounds Check Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=927 The DxgkDdiEscape handler for escape code 0x100010b looks like: char escape100010bNvMiniportDeviceContext miniportcontext, HANDLE handle, unsigned int idx PVOID Object; if...

NVIDIA Driver - Incorrect Bounds Check in Escape 0x70001b2

NVIDIA Driver - Incorrect Bounds Check in Escape 0x70001b2 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=940 The DxgkDdiEscape handler for 0x70001b2 doesn't do proper bounds checks for its variable size input. void sub8C4304... ... // escape-size is controlled by the user. if...

NVIDIA Driver - Escape 0x100010b Missing Bounds Check

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=927 The DxgkDdiEscape handler for escape code 0x100010b looks like: char escape100010bNvMiniportDeviceContext miniportcontext, HANDLE handle, unsigned int idx PVOID Object; if !handle dodebugthingo; Object = PVOID...

NVIDIA Driver - Incorrect Bounds Check in Escape 0x70001b2

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=940 The DxgkDdiEscape handler for 0x70001b2 doesn't do proper bounds checks for its variable size input. void sub8C4304... ... // escape-size is controlled by the user. if escape-size size; memcpyescape-data, v31, 28i64 size;...

NVIDIA Driver - Missing Bounds Check in Escape 0x100009a

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=942 The DxgkDdiEscape handler for escape 0x100009a lacks proper bounds checks: case 0x100009A: ... size0 = escapedata-size1; ... size1 = 2 - escapedata-unknown size2; ... totalsize = size0 size1 size2; ... if totalsize 0x10...

NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5

NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944 The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks: ... if gsavedsize escape-size = gsavedsize; if unsigned intgsavedsize 0 do v5 = v2++; escape-datav5 =...

NVIDIA Driver - Escape 0x100010b Missing Bounds Check

NVIDIA Driver - Escape 0x100010b Missing Bounds Check Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=927 The DxgkDdiEscape handler for escape code 0x100010b looks like: char escape100010bNvMiniportDeviceContext miniportcontext, HANDLE handle, unsigned int idx PVOID Object; if...

NVIDIA Driver - Missing Bounds Check in Escape 0x100009a

NVIDIA Driver - Missing Bounds Check in Escape 0x100009a Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=942 The DxgkDdiEscape handler for escape 0x100009a lacks proper bounds checks: case 0x100009A: ... size0 = escapedata-size1; ... size1 = 2 - escapedata-unknown size2;...

NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944 The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks: ... if gsavedsize escape-size = gsavedsize; if unsigned intgsavedsize 0 do v5 = v2++; escape-datav5 = globalarrayv5 + 77; while v2 size 0 do ii = i++; globalarrayii +...

kernel: netfilter: missing bounds check in ipt_entry structure

A security flaw was found in the Linux kernel in the marksourcechains function in "net/ipv4/netfilter/iptables.c". It is possible for a user-supplied "iptentry" structure to have a large "nextoffset" field. This field is not bounds checked prior to writing to a counter value at the supplied offse...

kernel: netfilter: missing bounds check in ipt_entry structure

A security flaw was found in the Linux kernel in the marksourcechains function in "net/ipv4/netfilter/iptables.c". It is possible for a user-supplied "iptentry" structure to have a large "nextoffset" field. This field is not bounds checked prior to writing to a counter value at the supplied offse...

Linux kernel buffer overflow vulnerability (CNVD-2016-04392)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A buffer overflow vulnerability exists in the Linux kernel. An attacker can exploit the vulnerability by calling hiddev ioctl with the HIDIOCGUSAGES or HIDIOCSUSAGES commands ...

Libksba denial of service vulnerability

Libksba is a library that simplifies work tasks for X.509 certificates, CMS data and related objects. Libksba fails to properly check object lengths, allowing remote attackers to exploit the vulnerability to trigger out-of-bounds reads, resulting in a denial-of-service attack...

UBUNTU-CVE-2016-3710

The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue...

Samsumg android phone v4l-subdev driver memory corruption vulnerability

Samsumg android phone is a series of cell phone products based on the Android platform developed by South Korea's Samsung Samsung. A memory corruption vulnerability exists in the 'msmsensorconfig' function in the v4l-subdev driver of the samsumg android phone, which stems from the program's failu...

Putty pscp 0.66 - Stack Buffer Overwrite

Exploit for multiple platform in category dos / poc Source: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563 Author: Date: Feb 20th, 2016 Name: putty Vendor: sgtatham - http://www.chiark.greenend.org.uk/sgtatham/putty/ Version: 0.59 3 9 years ago = affected = 0.66 Platforms: win/ni...