455 matches found
Remote Symbol Resolution
Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...
Remote Symbol Resolution
Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...
gdal: Incorrect-function-pointer-type in OGRCurve::CastToLineString
Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5600546717171712 Project: gdal Fuzzer: libFuzzergdalogrfuzzer Fuzz target binary: ogrfuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Cras...
Citrix Provisioning Services 7.x < 7.12 Multiple Vulnerabilities (CTX219580)
The version of Citrix Provisioning Services running on the remote Windows host is either 7.x prior to 7.12 or 7.6 LTSR prior to 7.6.4 LTSR. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to an overflow condition caused by improper...
CVE-2016-9679
Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer...
CVE-2016-9679
Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer...
CVE-2016-9679
Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer...
CVE-2016-9679: Improper Restriction of Operations within the Bounds of a Memory Buffer
Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer...
PT-2017-10261
Name of the Vulnerable Software and Affected Versions Citrix Provisioning Services versions prior to 7.12 Description The issue allows attackers to execute arbitrary code by overwriting a function pointer. Recommendations For versions prior to 7.12, update to version 7.12 or later to resolve the...
Reverse Safety series: Use After Free vulnerability analysis-vulnerability warning-the black bar safety net
One, Foreword Thinking the next step is to write a use after free small summary, just happened to be the nearest Lake Gordon Cup 2016 the one.---- game Use the use after free can be out. This title is their first in more formal competitions, make pwn title, do this question of time spent a lot, t...
Oracle IOT IX SDK libvs_pdf XRef Index Code Execution Vulnerability
Talos Vulnerability Report TALOS-2016-0086 Oracle IOT IX SDK libvspdf XRef Index Code Execution Vulnerability April 19, 2016 CVE Number CVE-2016-3455 DESCRIPTION A vulnerability in PDF parser of the IX SDK exists that allows an out of bounds heap memory overwrite potentially leading to remote cod...
Fedora 23 : glibc-2.22-6.fc23 (2015-7174c4d68d)
This update re-adds large file support to the openat function, removes support for the LDPOINTERGUARD environment variable which could be used to weaken security protections in ATSECURE/SUID binaries, and adds function pointer obfuscation to the TLS destructor list. Note that Tenable Network...
Internet Bug Bounty: Type confusion in partial.setstate, partial_repr, partial_call leads to memory corruption, reliable control flow hijack
See my official writeups here: http://bugs.python.org/issue25944 http://bugs.python.org/issue25945 The maintainers merged these bug reports. In one case, the type confusion leads to a reliable control of the instruction pointer as calling repr on a corrupted partial calls a function pointer that ...
PT-2015-3393
Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.3.3 Description The issue is related to the networking implementation in the Linux kernel, which does not properly validate protocol identifiers for certain protocol families. This can be exploited by local user...
Null pointer dereference
The Monitor Control Command Set kernel extension in the Display Drivers subsystem in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages control of a function pointer...
CVE-2015-3691: Improper Access Control
The Monitor Control Command Set kernel extension in the Display Drivers subsystem in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages control of a function pointer...
ComSndFTP 1.3.7 Beta - USER Format String (Write4) Vulnerability
No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit...
MagicISO <= 5.4 (build239) - .cue File Heap Overflow PoC
No description provided by source. !/usr/bin/env ruby Credits to n00b for finding this bug. Magic iso has a stacked based buffer over-flow when We pass an overly-long file name inside the .cue file We are able to control alot of the registers so Command execution is possible,But im still learning...
Sybase Advantage Data Architect - "*.SQL" Format Heap Oveflow
No description provided by source. Exploit Title: Sybase Advantage Data Architect .SQL Format Heap Oveflow RCE Date: 2010-10-16 Author: d0lc3 @rmallof - http://elotrolad0.blogspot.com/ Software Link: http://www.sybase.com/products/databasemanagement/advantagedatabaseserver/data-architect-utility...