Hashicorp vagrant-vmware-fusion <= 4.0.20 - Local root Privilege Esclation Exploit

Exploit for macOS platform in category local exploits I'm a big fan of Hashicorp but this is an awful bug to have in software of their calibre. Their vagrant plugin for vmware fusion uses a product called Ruby Encoder to protect their proprietary ruby code. It does this by turning the ruby code...

Hashicorp vagrant-vmware-fusion 4.0.20 Privilege Escalation

CVE-2017-7642 Local root privesc in Hashicorp vagrant-vmware-fusion " - i.e. it doesn't verify the path to the ruby script and it doesn't scrub the PATH variable either. We can easily exploit this to get root. Hashicorp were quick to respond and kindly paid me a small bounty f...

Mozilla Firefox and Firefox ESR Opus encoder out-of-bounds read vulnerability

Mozilla Firefox is an open source web browser. An out-of-bounds read vulnerability exists in the Mozilla Firefox Opus encoder, which can be exploited by a remote attacker to construct a malicious web page and trick the user into parsing it, which can crash the application or execute arbitrary cod...

Interactive Security Reference Tool: BroSec

Interactive Security Reference Tool An interactive reference tool to help security professionals utilize useful payloads and commands Brosec is a terminal based reference utility designed to help us infosec bros and broettes with useful yet sometimes complex payloads and commands that are often...

LAME 3.99.5 - III_dequantize_sample Stack Buffer Overflow

LAME 3.99.5 - IIIdequantizesample Stack Buffer Overflow Description: lame is a high quality MPEG Audio Layer III MP3 encoder licensed under the LGPL. Few notes before the details of this bug. Time ago a fuzz was done by Brian Carpenter and Jakub Wilk which posted the results on the debian...

UBUNTU-CVE-2017-9870

The IIIistereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service buffer over-read and application crash via a crafted audio file that is mishandled in the code for the "blocktype == 2" case, a similar...

The vulnerability of the AVEVideoEncoder component in the iOS operating system allows a hacker to trigger a service failure or execute arbitrary code in a privileged context.

The vulnerability of the AVEVideoEncoder component in the iOS operating system arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged context, or trigger a service failure memory...

The vulnerability of the AVEVideoEncoder component in the iOS operating system allows a hacker to trigger a service failure or execute arbitrary code in a privileged context.

The vulnerability of the AVEVideoEncoder component in the iOS operating system arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged context, or trigger a service failure memory...

The vulnerability of the AVEVideoEncoder component in the iOS operating system allows a hacker to trigger a service failure or execute arbitrary code in a privileged context.

The vulnerability of the AVEVideoEncoder component in the iOS operating system arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged context, or trigger a service failure memory...

UBUNTU-CVE-2017-9130

The faacEncOpen function in libfaac/frame.c in Freeware Advanced Audio Coder FAAC 1.28 allows remote attackers to cause a denial of service invalid memory read and application crash via a crafted wav file...

Mozilla: Out-of-bounds read in Opus encoder (MFSA 2017-16)

An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. This vulnerability affects Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2...

Security fix for the ALT Linux 10 package firefox-esr version 52.2.0-alt1

June 21, 2017 Andrey Cherepanov 52.2.0-alt1 - New ESR version 52.2.0 - Security fixes: + CVE-2017-5472: Use-after-free using destroyed node when regenerating trees + CVE-2017-7749: Use-after-free during docshell reloading + CVE-2017-7750: Use-after-free with track elements + CVE-2017-7751:...

Security update for Mozilla based packages (important)

This update for Mozilla Firefox, Thunderbird, and NSS fixes the following issues: Mozilla Firefox was updated to 52.2esr boo1043960 MFSA 2017-16: CVE-2017-5472 bmo1365602 Use-after-free using destroyed node when regenerating trees CVE-2017-7749 bmo1355039 Use-after-free during docshell reloading...

Freeware Advanced Audio Coder (FAAC) 1.28 - Denial of Service

Freeware Advanced Audio Coder FAAC 1.28 - Denial of Service Freeware Advanced Audio Coder FAAC multiple vulnerabilities ================ Author : qflb.wu =============== Introduction: ============= FAAC is an encoder for a lossy sound compression scheme specified in MPEG-2 Part 7 and MPEG-4 Part ...

Freeware Advanced Audio Coder (FAAC) 1.28 - Denial of Service

Freeware Advanced Audio Coder FAAC multiple vulnerabilities ================ Author : qflb.wu =============== Introduction: ============= FAAC is an encoder for a lossy sound compression scheme specified in MPEG-2 Part 7 and MPEG-4 Part 3 standards and known as Advanced Audio Coding AAC. This...

Freeware Advanced Audio Coder (FAAC) 1.28 Denial Of Service

Freeware Advanced Audio Coder FAAC multiple vulnerabilities ================ Author : qflb.wu =============== Introduction: ============= FAAC is an encoder for a lossy sound compression scheme specified in MPEG-2 Part 7 and MPEG-4 Part 3 standards and known as Advanced Audio Coding AAC. This...

[SECURITY] Fedora 24 Update: capnproto-0.5.3.1-1.fc24

Cap=EF=BF=BD=EF=BF=BD=EF=BF=BDn Proto is an insanely fast data interchange format and capability-based RPC system. Think JSON, except binary. Or think Protocol Buffers, except faster. In fact, in benchmarks, Cap=EF=BF=BD=EF=BF=BD=EF=BF=BDn Proto is INFINITY TIMES faster than Protoco l Buffers. Th...

[SECURITY] Fedora 26 Update: capnproto-0.6.1-3.fc26

Cap=EF=BF=BD=EF=BF=BD=EF=BF=BDn Proto is an insanely fast data interchange format and capability-based RPC system. Think JSON, except binary. Or think Protocol Buffers, except faster. In fact, in benchmarks, Cap=EF=BF=BD=EF=BF=BD=EF=BF=BDn Proto is INFINITY TIMES faster than Protoco l Buffers. Th...

[ASA-201706-20] thunderbird: multiple issues

Arch Linux Security Advisory ASA-201706-20 ========================================== Severity: Critical Date : 2017-06-16 CVE-ID : CVE-2017-5470 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7764 CVE-2017-77...

Mozilla: Out-of-bounds read in Opus encoder (MFSA 2017-16)

An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. This vulnerability affects Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2...