75 matches found
May 9, 2017—KB4019213 (Security-only update)
None None...
April 11, 2017—KB4015547 (Security-only update)
None None...
Microsoft Windows Kernel - Registry Hive Loading Crashes in nt!nt!HvpGetBinMemAlloc nt!ExpFindAndRemoveTagBigPages (MS17-017)
Microsoft Windows Kernel - Registry Hive Loading Crashes in nt!nt!HvpGetBinMemAlloc nt!ExpFindAndRemoveTagBigPages MS17-017 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=993 We have encountered Windows kernel crashes in the internal nt!nt!HvpGetBinMemAlloc and...
HEVD kernel vulnerability training of SMEP bypass-vulnerability warning-the black bar safety net
This articles content comparison basis, but also more fun, of course, has been to see the yuan brother mentioned DVE bypass mitigation, on the DVE feel very magical, but I still do not quite understand, very want to learn. Two days before the in security client sent an article HEVD kernel...
Microsoft Windows Kernel - Registry Hive Loading 'nt!RtlEqualSid' Out-of-Bounds Read (MS
Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=874 We have encountered a Windows kernel crash in the nt!RtlEqualSid function invoked through nt!SeAccessCheck by nt!CmpCheckSecurityCellAccess while loading corrupted registry hiv...
Microsoft Windows Kernel - Registry Hive Loading nt!RtlEqualSid Out-of-Bounds Read (MS16-138)
Microsoft Windows Kernel - Registry Hive Loading nt!RtlEqualSid Out-of-Bounds Read MS16-138 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=874 We have encountered a Windows kernel crash in the nt!RtlEqualSid function invoked through nt!SeAccessCheck by...
Microsoft Windows - win32k.sys TTF Processing win32k!sbit_Embolden win32k!ttfdCloseFontContext Use-After-Free (MS16-120)
Microsoft Windows - win32k.sys TTF Processing win32k!sbitEmbolden win32k!ttfdCloseFontContext Use-After-Free MS16-120 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=868 We have encountered Windows kernel crashes in the win32k!sbitEmbolden and win32k!ttfdCloseFontContext functio...
Microsoft Windows - 'win32k.sys' TTF Processing win32k!sbit_Embolden / win32k!ttfdCloseFontContext Use-After-Free (MS16-120)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=868 We have encountered Windows kernel crashes in the win32k!sbitEmbolden and win32k!ttfdCloseFontContext functions while processing corrupted TTF font files. Excerpts of them are shown below: --- KERNELMODEEXCEPTIONNOTHANDLED 8e...
Microsoft Windows10 AHCACHE.SYS Remote Denial Of Service
Summary A denial of service vulnerability exists in the AHCACHE.SYS driver. A specially crafted Portable Executable file can cause a bugcheck in the Windows kernel resulting in remote denial of service. Tested Versions Windows 10, AHCACHE.SYS version 10.0.10586.0 Tested on Windows 10 X86 Product...
SymantecNorton AntiVirus - ASPack Remote HeapPool Memory Corruption
SymantecNorton AntiVirus - ASPack Remote HeapPool Memory Corruption Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=820 When parsing executables packed by an early version of aspack, a buffer overflow can occur in the core Symantec Antivirus Engine used in most Symantec and Nort...
Symantec/Norton AntiVirus - ASPack Remote Heap/Pool Memory Corruption
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=820 When parsing executables packed by an early version of aspack, a buffer overflow can occur in the core Symantec Antivirus Engine used in most Symantec and Norton branded Antivirus products. The problem occurs when section data ...
Symantec / Norton AntiVirus - ASPack Remote Heap/Pool Memory Corruption
Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=820 When parsing executables packed by an early version of aspack, a buffer overflow can occur in the core Symantec Antivirus Engine used in most Symantec and Norton branded...
VBox Satellite Express Arbitrary Write Privilege Escalation
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 KL-001-2015-005 : VBox Satellite Express Arbitrary Write Privilege Escalation Title: VBox Satellite Express Arbitrary Write Privilege Escalation Advisory ID: KL-001-2015-005 Publication Date: 2015.09.16 Publication URL:...
Microsoft Windows Win32k.sys - Denial of Service Vulnerability
Exploit for windows platform in category dos / poc Exploit Title: Microsoft Windows Win32k.sys Denial of Service Date: 20-11-2014 Exploit Author: Kedamsky email protected Vendor Homepage: http://microsoft.com Software Link: http://www.microsoft.com/en-us/download/windows.aspx Version: XP SP3, Vis...
Microsoft Windows - win32k.sys Denial of Service
Microsoft Windows - win32k.sys Denial of Service Exploit Title: Microsoft Windows Win32k.sys Denial of Service Date: 20-11-2014 Exploit Author: Kedamsky [email protected] Vendor Homepage: http://microsoft.com Software Link: http://www.microsoft.com/en-us/download/windows.aspx Version: XP SP3, Vist...
Microsoft XP SP3 MQAC.sys - Arbitrary Write Privilege Escalation Exploit
Exploit for windows platform in category local exploits Title: Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation Publication Date: 2014.07.18 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2014-003.txt 1. Vulnerability Details Affected Vendor: Microsoft Affect...
FortKnox Personal Firewall 9.0.305.0 & 10.0.305.0 - Kernel Driver (fortknoxfw.sys) Memory Corruption Vulnerability
No description provided by source. / Exploit Title: 0day FortKnox Personal Firewall kernel driver fortknoxfw.sys memory corruption vulnerability Date: 25/10/2013 Author: Arash Allebrahim Contact : [email protected] Vendor Homepage: http://www.fortknox-firewall.com/ Vulnerable software :...
Microsoft Windows win32k!GreStretchBltInternal() Does Not Handle src == dest
No description provided by source. Microsoft Windows win32k!GreStretchBltInternal does not handle src == dest ---------------------------------------------------------------------------- A bitblt bit block transfer is used to copy one rectangular region of screen to another, often performing a...
win32k!EPATHOBJ::pprFlattenRec Uninitialized Next Pointer Testcase
No description provided by source. I'm quite proud of this list cycle trick, here's how to turn it into an arbitrary write. First, we create a watchdog thread that will patch the list atomically when we're ready. This is needed because we can't exploit the bug while HeavyAllocPool is failing,...
Windows Win32k Pointer Dereferencement PoC (MS10-098)
No description provided by source. / MS10-098 CVE-2010-3944 Microsoft Windows Win32k pointer dereferencement -------------------- Affected Software ------------------------ Microsoft Windows 7 / 2008 -------------------- Consequences ----------------------- An unprivileged user may be able to cau...