libmikmod 3.2.2 - GT2 Loader Local Heap Overflow (PoC)

libmikmod 3.2.2 - GT2 Loader Local Heap Overflow PoC / by Luigi Auriemma / include include include include define VER "0.1" define cpyx,y strncpyx, y, sizeofx; void fwi08FILE fd, int num; void fwi16FILE fd, int num; void fwi32FILE fd, int num; void fwstrFILE fd, uint8t str; void fwmemFILE fd,...

Heap overflow in the GT2 loader of libmikmod 3.2.2

Luigi Auriemma Application: libmikmod http://mikmod.raphnet.net http://sourceforge.net/projects/mikmod/ Versions: = 3.2.2 and current CVS versions 2.x.x and all the others in which the GT2 file format isn't implemented are not vulnerable Platforms: Windows, POSIX, Mac Bug: heap overflow in GT2's...

libmikmod 3.2.2 - GT2 Loader Local Heap Overflow (PoC)

/ by Luigi Auriemma / include include include include define VER "0.1" define cpyx,y strncpyx, y, sizeofx; void fwi08FILE fd, int num; void fwi16FILE fd, int num; void fwi32FILE fd, int num; void fwstrFILE fd, uint8t str; void fwmemFILE fd, uint8t data, int size; void stderrvoid; pragma pack1...

Buffer-overflow in the XM loader of Cheese Tracker 0.9.9

Luigi Auriemma Application: Cheese Tracker http://reduz.com.ar/cheesetracker/ http://sourceforge.net/projects/cheesetronic Versions: = 0.9.9 and current CVS Platforms: nix and others Bug: buffer-overflow in LoaderXM::loadinstrumentinternal Exploitation: local Date: 23 Jul 2006 Author: Luigi...

DEBIAN-CVE-2006-3404

Buffer overflow in the xcfloadvector function in app/xcf/xcf-load.c for gimp before 2.2.12 allows user-assisted attackers to cause a denial of service crash and possibly execute arbitrary code via an XCF file with a large numaxes value in the VECTORS property...

CVE-2004-0138

CVE-2004-0138 affects the Linux kernel 2.4 series prior to 2.4.25. The vulnerability lies in the ELF loader: a crafted ELF with an invalid interpreter arch triggers a BUG() when an invalid VMA is unmapped, allowing local denial of service (crash). The issue is mitigated by upgrading to 2.4.25 or ...

CVE-2004-0138

The ELF loader in Linux kernel 2.4 before 2.4.25 allows local users to cause a denial of service crash via a crafted ELF file with an interpreter with an invalid arch architecture, which triggers a BUG when an invalid VMA is unmapped...

PT-2006-3356 · Popphoto · Popphoto Studio

Name of the Vulnerable Software and Affected Versions: PopPhoto Studio versions 3.5.4 and earlier Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the include path parameter, specifically through the cfg'popphoto base path' variable in the...

USN-263-1: Linux kernel vulnerabilities

A flaw was found in the module reference counting for loadable protocol modules of netfilter. By performing particular socket operations, a local attacker could exploit this to crash the kernel. This flaw only affects Ubuntu 5.10. CVE-2005-3359 David Howells noticed a race condition in the addkey...

Ubuntu 4.10 / 5.04 / 5.10 : linux-source-2.6.8.1/-2.6.10/-2.6.12 vulnerabilities (USN-263-1)

A flaw was found in the module reference counting for loadable protocol modules of netfilter. By performing particular socket operations, a local attacker could exploit this to crash the kernel. This flaw only affects Ubuntu 5.10. CVE-2005-3359 David Howells noticed a race condition in the addkey...

Ubuntu 4.10 / 5.04 / 5.10 : gtk+2.0, gdk-pixbuf vulnerabilities (USN-216-1)

Two integer overflows have been discovered in the XPM image loader of the GDK pixbuf library. By tricking an user into opening a specially crafted XPM image with any Gnome desktop application that uses this library, this could be exploited to execute arbitrary code with the privileges of the user...

USN-216-1: GDK vulnerabilities

Two integer overflows have been discovered in the XPM image loader of the GDK pixbuf library. By tricking an user into opening a specially crafted XPM image with any Gnome desktop application that uses this library, this could be exploited to execute arbitrary code with the privileges of the user...

iDEFENSE Security Advisory 11.15.05: Multiple Vendor GTK+ gdk-pixbuf XPM Loader Heap Overflow Vulnerability

Multiple Vendor GTK+ gdk-pixbuf XPM Loader Heap Overflow Vulnerability iDEFENSE Security Advisory 11.15.05 www.idefense.com/application/poi/display?id=339&type=vulnerabilities November 15, 2005 I. BACKGROUND GTK+ is a multi-platform toolkit for creating graphical user interfaces. Offering a...

Slackware 10.0 / current : GTK+ image loading flaws (SSA:2004-266-02)

New GTK+ version 2 packages are available for Slackware 10.0 and -current to fix issues in the image loader routines that can crash applications. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security...

[Full-disclosure] JBoss jBPM 2.0: Remote code execution and classloader covert channel

Security Advisory: jBPM 2.0 Date: 06/22/05 URL: http://www.illegalaccess.org/java/jbpm.php " JBoss jBPM is a flexible, extensible workflow management system." jbpm.org Problem 1: Remote code execution possible with jBPM . This allows an attacker to trigger an arbitrary executable on the jBPM/ JBo...

Fedora Core 2 : kernel-2.6.10-1.771_FC2 (2005-262)

Sun Mar 27 2005 Dave Jones - Catch up with all recent security issues. - CVE-2005-0210 : dst leak - CVE-2005-0384 : ppp dos - CVE-2005-0531 : Sign handling issues. - CVE-2005-0400 : EXT2 information leak. - CVE-2005-0449 : Remote oops. - CVE-2005-0736 : Epoll overflow - CVE-2005-0749 : ELF loader...

Linux kernel ELF core dump privilege elevation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, since it became clear from the discussion in January about the uselib vulnerability, that the Linux community prefers full, non-embargoed disclosure of kernel bugs, I release full details right now. However to follows at least some of the...

Subversion 0.3.71.0.0 - Remote Buffer Overflow

Subversion 0.3.71.0.0 - Remote Buffer Overflow / hoagiesubversion.c Remote exploit against Subversion-Servers. Author: greuff Tested on Subversion 1.0.0 and 0.37 Algorithm: This is a two-stage exploit. The first stage overflows a buffer on the stack and leaves us 60 bytes of machine code to be...

CVE-2005-0975

Integer signedness error in the parsemachfile function in the mach-o loader machloader.c for the Darwin Kernel as used in Mac OS X 10.3.7, and other versions before 10.3.9, allows local users to cause a denial of service CPU consumption via a crafted mach-o header...

CVE-2005-0975

CVE-2005-0975 describes an integer signedness error in the Darwin kernel’s mach-o loader (mach_loader.c) used by Mac OS X 10.3.7 and earlier versions (before 10.3.9). The vulnerability allows local users to cause a denial of service (CPU consumption) by presenting a crafted mach-o header. The pro...