CVE-2013-4636

CVE-2013-4636 affects PHP 5.4.x prior to 5.4.16. The vulnerability is in the mget function of libmagic/softmagic.c (Fileinfo) and allows remote denial of service via an MP3 file that triggers incorrect MIME type detection when accessing a finfo object. Impact is DoS (invalid pointer dereference a...

CVE-2013-4636

The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service invalid pointer dereference and application crash via an MP3 file that triggers incorrect MIME type detection during access to an finfo object...

PHP "php_quot_print_encode()"缓冲区溢出漏洞(CVE-2013-2110)

Bugtraq ID:60411 CVE ID:CVE-2013-2110 PHP是一种HTML内嵌式的语言。 "phpquotprintencode"函数ext/standard/quotprint.c在解析字符串时存在一个基于堆的缓冲区溢出，允许攻击者利用此漏洞以应用程序上下文执行任意代码。 此外在解析MP3文件的MIMETYPE时存在一个安全问题，可导致PHP 5.4.15版本崩溃。 0 PHP 5.3.x PHP 5.4.x 厂商解决方案 PHP 5.4.16或5.3.26已经修复此漏洞，建议用户下载更新： http://www.php.net/...

Apple QuickTime Multiple Vulnerabilities (Jun 2013) - Windows

QuickTime Player is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:quicktime";...

PHP 5.4.x < 5.4.16 Multiple Vulnerabilities

According to its banner, the version of PHP 5.4.x installed on the remote host is prior to 5.4.16. It is, therefore, potentially affected by the following vulnerabilities: - An error exists in the mimetype detection of 'mp3' files that could lead to a denial of service. Bug 64830 - An error exist...

Apple QuickTime MP3 Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

APPLE-SA-2013-05-22-1 QuickTime 7.7.4

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-05-22-1 QuickTime 7.7.4 QuickTime 7.7.4 is now available and addresses the following: QuickTime Available for: Windows 7, Vista, XP SP2 or later Impact: Opening a maliciously crafted TeXML file may lead to an unexpected application...

CVE-2013-0989

Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted MP3 file...

Buffer overflow

Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted MP3 file...

CVE-2013-0989

Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted MP3 file...

CVE-2013-0989

CVE-2013-0989 : A buffer overflow in Apple QuickTime prior to 7.7.4 can be triggered by a crafted MP3 file, allowing remote attackers to execute arbitrary code or cause a denial of service (application crash). Public references in the providedOpenVAS/Nessus data confirm QuickTime as the vulnerabl...

Downloadify Allowed Songs to be Downloaded for Free

One of the largest online music streaming services was briefly singing a different tune after learning a new Google Chrome plug-in allowed users to download copies of songs for free. Google this week pulled from its Chrome Web Store the browser extension known as Downloadify, which exploited a...

SA-CONTRIB-2013-043 - MP3 Player - Cross Site Scripting (XSS)

This module enables you to easily enable a Flash MP3 Player on a CCK FileField. The module doesn't sufficiently filter user-supplied text from mp3 filenames. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create a node with an mp3 filefield wi...

Dotclear 2.4.4 Cross Site Scripting / Content Spoofing

Hello list! These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. CMS Dotclear has three vulnerable flash-files: swfupload.swf, playerflv.swf and playermp3.swf. File swfupload.swf it's Swfupload. I've wrote about vulnerabilities in Swfupload in November 2012...

VirtualDJ ProHome 7.3 - Local Buffer Overflow

VirtualDJ ProHome 7.3 - Local Buffer Overflow Exploit Title: VirtualDJ Pro/Home =7.3 Buffer Overflow Vulnerability Date: 23.03.2013 Exploit Author: Alexandro Sánchez Bach functionmixer.blogspot.com Vendor Homepage: http://www.virtualdj.com/ Software Link:...

Ruby Gem ldoce 0.0.2 Command Execution Vulnerability

Ruby Gem ldoce version 0.0.2 suffers from a command execution vulnerability. Remote command execution in Ruby Gem ldoce 0.0.2 Larry W. Cashdollar @larry0 3/25/2013 Ldoce Ruby Gem: Easily interface with the Longman Dictionary of Contemporary English API from Ruby: NB currently mac only as it depen...

ldoce Gem for Ruby MP3 URL Shell Metacharacter Injection Arbitrary Command Execution

ldoce Gem for Ruby contains a flaw that is triggered during the handling of a specially crafted URL or filename for MP3 files that have shell metacharacters injected in to it. This may allow a context-dependent attacker to execute arbitrary commands...

IconCool MP3 WAV Converter 3.00 Build 120518 - Stack Buffer Overflow Vulnerability

Exploit for windows platform in category dos / poc Exploit Title: IconCool MP3 WAV Converter Stack Buffer Overflow Vulnerability Date: 3/24/2013 Exploit Author: G0li47h Vendor Homepage: http://www.iconcool.com Software Link: http://www.iconcool.com/insticoncoolmp3wavconverter.exe Version: v3.00...

IconCool MP3 WAV Converter 3.00 Build 120518 - Stack Buffer Overflow

Exploit Title: IconCool MP3 WAV Converter Stack Buffer Overflow Vulnerability Date: 3/24/2013 Exploit Author: G0li47h Vendor Homepage: http://www.iconcool.com Software Link: http://www.iconcool.com/insticoncoolmp3wavconverter.exe Version: v3.00 Build 120518 Tested on: Windows 7 SP1 my $file=...

IconCool MP3 WAV Converter 3.00 Build 120518 Buffer Overflow

Exploit Title: IconCool MP3 WAV Converter Stack Buffer Overflow Vulnerability Date: 3/24/2013 Exploit Author: G0li47h Vendor Homepage: http://www.iconcool.com Software Link: http://www.iconcool.com/insticoncoolmp3wavconverter.exe Version: v3.00 Build 120518 Tested on: Windows 7 SP1 my $file=...