shopify-scripts: SIGSEGV - mrb_vm_exec - line:1681

PoC: ------------------- The following code triggers the bug attached as testmrbvmexec1681.rb: def try yield ensure yield end a=lambda do a.try do return end end.call Mirb - Debug: ------------------- gdb r testmrbvmexec1678.rb The program being debugged has been started already. Start it from th...

Fuzzer for Individual Method Parameters: RamFuzz

Fuzzer for Individual Method Parameters RamFuzz is a fuzzer for individual method parameters in unit tests. A unit test can use RamFuzz to generate random parameter values for methods under test. The values are logged, and the log can be replayed to repeat the exact same test scenario. But RamFuz...

shopify-scripts: SIGSEGV - mrb_check_intern_str() - NullPointer

PoC --------------------- The following code triggers the bug attached as mrbvmexec.rb: def tostr $s.replace""end $s="" class Test00espondTo end Test00espondTo.respondto?0 Crash - mirb --------------------- x@x:/Desktop/research/mruby/bin$ ./mirb mrbcheckinternstr.rb mirb - Embeddable Interactive...

What the Fuzz: Radamsa

What the Fuzz: Radamsa Radamsa is a test case generator for robustness testing, a.k.a. a fuzzer. It is typically used to test how well a program can withstand malformed and potentially malicious inputs. It works by reading sample files of valid data and generating interestingly different outputs...

Apple OS XiOS Kernel - IOSurface Use-After-Free

Apple OS XiOS Kernel - IOSurface Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=831 IOSurfaceRootUserClient stores a task struct pointer passed in via IOServiceOpen in the field at +0xf0 without taking a reference. By killing the corrisponding task we can free th...

Internet Bug Bounty: PHP Integer Overflow in gdImageWebpCtx

PHP Integer Overflow in gdImageWebpCtx 1. Affected Version + PHP 7.0.10 2. Credit This vulnerability was discovered by Ke Liu of Tencent's Xuanwu LAB. 3. Testing Environments + OS: Ubuntu + PHP: 7.0.10 + Compiler: Clang + CFLAGS: -g -O0 -fsanitize=address 4. PoC 5. Vulnerability Details...

Internet Bug Bounty: CVE-2016-7418 PHP Out-Of-Bounds Read in php_wddx_push_element

CVE-2016-7418 PHP Out-Of-Bounds Read in phpwddxpushelement 1. Affected Version + PHP 7.0.10 + PHP 5.6.25 2. Credit This vulnerability was discovered by Ke Liu of Tencent's Xuanwu LAB. 3. Testing Environments + OS: Ubuntu + PHP: 7.0.10 + Compiler: Clang + CFLAGS: -g -O0 -fsanitize=address 4. PoC...

Internet Bug Bounty: CVE-2016-3183 OpenJPEG sycc422_to_rgb Out-of-Bounds Read Vulnerability

CVE-2016-3183 OpenJPEG sycc422torgb Out-of-Bounds Read Vulnerability 1. About OpenJPEG OpenJPEG is an open-source JPEG 2000 codec written in C language. It's widely used in lots of Linux OSes such as Ubuntu, RedHat, Debian, Fedora, and so on. The official repository of the OpenJPEG project is...

Address Sanitizer in macOS-vulnerability warning-the black bar safety net

A few days ago, the Keen Team@marcograss on their blog released a using Address Sanitizeraka asan found a heap overflow vulnerability. Discuss here about asan implementation. This article relates to the environment macOS 10.11.6 Xcode 7.3.1 make sure to use the official Apple's clang, with the op...

Wireshark 1.12.0 1.12.12 - NDS Dissector Denial of Service

Wireshark 1.12.0 1.12.12 - NDS Dissector Denial of Service Sample generated with AFL Build Information: TShark 1.12.9 v1.12.9-0-gfadb421 from HEAD Copyright 1998-2015 Gerald Combs and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for...

Apple Mac OSX - Kernel AppleKeyStore Use-After-Free

Exploit for macOS platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=710 The AppleKeyStore userclient uses an IOCommandGate to serialize access to its userclient methods, however by racing two threads, one of which closes the userclient which frees...

Fedora 23 : webkitgtk4-2.10.9-1.fc23 (2016-7eb48a78dc)

This update together with the previous release brings the following fixes Security fixes: CVE-2016-1726 Limit the number of tiles according to the visible area. This was causing a huge memory consumption with some websites. Fix rendering of form controls and scrollbars with GTK+ = 3.19. Fix HTTP...

Fedora 22 : ecryptfs-utils-109-1.fc22 (2016-7b9a2fe987)

manpage ecryptfs-migrate-home.8: Fix typos - clang static analysis fixes - Refuse to mount over non-standard filesystems. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox / mozilla-nss (SUSE-SU-2014:1510-1)

update to Firefox 31.2.0 ESR bnc900941 - MFSA 2014-74/CVE-2014-1574/CVE-2014-1575 bmo1001994, bmo1011354, bmo1018916, bmo1020034, bmo1023035, bmo1032208, bmo1033020, bmo1034230, bmo1061214, bmo1061600, bmo1064346, bmo1072044, bmo1072174 Miscellaneous memory safety hazards rv:33.0/rv:31.2 - MFSA...

APPLE-SA-2015-04-08-5 Xcode 6.3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2015-04-08-5 Xcode 6.3 Xcode 6.3 is now available and addresses the following: Clang Available for: OS X Mavericks v10.9.4 or later Impact: An attacker may be able to bypass stack guards Description: A register allocation issue existed in...

[ MDVSA-2015:170 ] gcc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:170 http://www.mandriva.com/en/support/security/ Package : gcc Date : March 30, 2015 Affected: Business Server 2.0 Problem Description: Updated gcc packages fix the following security issue: Multiple integer...

CVE-2015-3027

Clang in LLVM, as used in Apple Xcode before 6.3, performs incorrect register allocation in a way that triggers stack storage for stack cookie pointers, which might allow context-dependent attackers to bypass a stack-guard protection mechanism via crafted input to an affected C program...

CVE-2015-3027

Clang in LLVM, as used in Apple Xcode before 6.3, performs incorrect register allocation in a way that triggers stack storage for stack cookie pointers, which might allow context-dependent attackers to bypass a stack-guard protection mechanism via crafted input to an affected C program...

UBUNTU-CVE-2015-3027

Clang in LLVM, as used in Apple Xcode before 6.3, performs incorrect register allocation in a way that triggers stack storage for stack cookie pointers, which might allow context-dependent attackers to bypass a stack-guard protection mechanism via crafted input to an affected C program...

CVE-2015-3027

CVE-2015-3027 concerns Clang in LLVM as used in Apple Xcode prior to 6.3, where incorrect register allocation triggers stack storage for stack-cookie pointers. This behavior can allow context-dependent attackers to bypass the stack-guard protection mechanism in an affected C program. The provided...