Apple macOSiOS Kernel 10.12.3 (16D32) - SIOCSIFORDER Socket ioctl Memory Corruption Due to Bad Bounds Checking

Apple macOSiOS Kernel 10.12.3 16D32 - SIOCSIFORDER Socket ioctl Memory Corruption Due to Bad Bounds Checking / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1108 SIOCSIFORDER is a new ioctl added in iOS 10. It can be called on a regular tcp socket, so from pretty much any...

Cain And Abel RDP File Stack Buffer Overflow (CVE-2008-5405)

A stack-based buffer overflow exists in Oxid Cain and Abel. The vulnerability is due to insufficient bounds checking on a RDP file. A remote attacker could exploit this vulnerability by enticing a victim to open a specially crafted RDP file. Successful exploitation could allow administrator acces...

MacOS kernel code execution due to lack of bounds checking in AppleIntelCapriController::GetLinkConfig (CVE-2017-2443)

Selector 0x921 of IntelFBClientControl ends up in AppleIntelCapriController::GetLinkConfig This method takes a structure input and output buffer. It reads an attacker controlled dword from the input buffer which it uses to index an array of pointers with no bounds checking: This pointer is passed...

macOS Kernel 10.12.2 (16C67) - AppleIntelCapriController::GetLinkConfig Code Execution Due to Lack o

Exploit for macOS platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1071 Selector 0x921 of IntelFBClientControl ends up in AppleIntelCapriController::GetLinkConfig This method takes a structure input and output buffer. It reads an attacker controll...

MacOS kernel memory disclosure due to lack of bounds checking in AppleIntelCapriController::getDisplayPipeCapability(CVE-2017-2489)

MacOS kernel memory disclosure due to lack of bounds checking in AppleIntelCapriController::getDisplayPipeCapability Selector 0x710 of IntelFBClientControl ends up in AppleIntelCapriController::getDisplayPipeCapability. This method takes a structure input and output buffer. It reads an attacker...

MacOS/iOS kernel memory corruption due to bad bounds checking in necp_client_copy_interface（CVE-2017-2473）

necpclientcopyinterface contains this code where interfaceindex is an attacker controlled a uint32t that: if interfaceindex != IFSCOPENONE && intinterfaceindex = ifindex interface = ifindex2ifnetinterfaceindex; This leads to an interface pointer being read out of bounds. This can lead to kernel...

Apple macOS Kernel 10.12.2 (16C67) - 'AppleIntelCapriController::GetLinkConfig' Code Execution Due to Lack of Bounds Checking

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1071 Selector 0x921 of IntelFBClientControl ends up in AppleIntelCapriController::GetLinkConfig This method takes a structure input and output buffer. It reads an attacker controlled dword from the input buffer which it uses to...

Apple macOS/iOS Kernel 10.12.3 (16D32) - SIOCSIFORDER Socket ioctl Memory Corruption Due to Bad Bounds Checking

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1108 SIOCSIFORDER is a new ioctl added in iOS 10. It can be called on a regular tcp socket, so from pretty much any sandbox. it falls through to calling: ifnetresetorderorderedindices, ifo-ifocount where orderedindicies points to...

Out-of-bounds

Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field...

CVE-2017-5238

Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field...

CVE-2017-5238

The CVE-2017-5238 entry concerns the Eview EV-07S GPS Tracker, where a buffer/overflow happens due to insufficient boundary checks in several input configuration fields. The CNVD entry confirms the root cause as a lack of bounds checking that allows overflowing data from one variable into another...

CVE-2017-5238

Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field...

Cisco IOx Data in Motion Stack Overflow Vulnerability

A vulnerability in the Data-in-Motion DMo process installed with the Cisco IOx application environment could allow an unauthenticated, remote attacker to cause a stack overflow that could allow remote code execution with root privileges in the virtual instance running on an affected device...

VariCAD DWB File Stack Buffer Overflow

A stack buffer overflow vulnerability exists in VariCAD 2010. The vulnerability is due to insufficient bounds checking on a DWB file. A successful exploitation could lead to arbitrary code execution in the security context of the target user...

MGASA-2017-0074 Updated flac packages fix security vulnerability

FLAC 1.3.2 fixes a NULL pointer dereference bug and adds bounds checking in the encoder. It also fixes various non security-relevant issues...

Updated flac packages fix security vulnerability

FLAC 1.3.2 fixes a NULL pointer dereference bug and adds bounds checking in the encoder. It also fixes various non security-relevant issues...

Pharos PopUp Printer Client Heap Buffer Overflow Vulnerability (CNVD-2017-02628)

Pharos PopUp Printer Client is a suite of printer client software from Pharos Systems International. A heap buffer overflow vulnerability exists in Pharos PopUp Printer Client version 9.0, which originates when the program fails to adequately perform bounds detection on user-submitted data,...

CVE-2016-8387

An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a malformed PDF with an object encoded w/ multiple encoding types terminating with an LZW encoded type, an overflow may occur due to a lack of bounds checking by the LZW decoder. This can lead to code...

Heap overflow

An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a malformed PDF with an object encoded w/ multiple encoding types terminating with an LZW encoded type, an overflow may occur due to a lack of bounds checking by the LZW decoder. This can lead to code...

CVE-2016-8387

An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a malformed PDF with an object encoded w/ multiple encoding types terminating with an LZW encoded type, an overflow may occur due to a lack of bounds checking by the LZW decoder. This can lead to code...