9637 matches found
Linux Kernel <= 2.6.20 with DCCP Support Memory Disclosure Exploit
Exploit for linux platform in category local exploits ================================================================== Linux Kernel = 2.6.20 with DCCP support enabled. Kernel versions 2.6.20 lack DCCPSOCKOPTSENDCSCOV/DCCPSOCKOPTRECVCSCOV optnames for getsockopt call with SOLDCCP level, which ar...
Linux Kernel 2.6.20 with DCCP Support - Memory Disclosure (1)
/ Linux Kernel DCCP Memory Disclosure Vulnerability Synopsis: The Linux kernel is susceptible to a locally exploitable flaw which may allow local users to steal data from the kernel memory. Vulnerable Systems: Linux Kernel Versions: = 2.6.20 with DCCP support enabled. Kernel versions 2.6.20 lack...
Linux Kernel <= 2.6.20 with DCCP Support Memory Disclosure Exploit
No description provided by source. / Linux Kernel DCCP Memory Disclosure Vulnerability Synopsis: The Linux kernel is susceptible to a locally exploitable flaw which may allow local users to steal data from the kernel memory. Vulnerable Systems: Linux Kernel Versions: = 2.6.20 with DCCP support...
Linux Kernel 2.6.20 with DCCP Support - Memory Disclosure (1)
Linux Kernel 2.6.20 with DCCP Support - Memory Disclosure 1 / Linux Kernel DCCP Memory Disclosure Vulnerability Synopsis: The Linux kernel is susceptible to a locally exploitable flaw which may allow local users to steal data from the kernel memory. Vulnerable Systems: Linux Kernel Versions: =...
[Full-disclosure] Linux Kernel DCCP Memory Disclosure Vulnerability
Linux Kernel DCCP Memory Disclosure Vulnerability Synopsis: The Linux kernel is susceptible to a locally exploitable flaw which may allow local users to steal data from the kernel memory. Vulnerable Systems: Linux Kernel Versions: = 2.6.20 with DCCP support enabled. Kernel versions 2.6.20 lack...
MOPB-29-2007:PHP 5.2.1 unserialize() Information Leak Vulnerability
Summary The new S: data type added to PHP 5.2.1's serialisation format is completely broken. The new feature it is supposed to add, the handling of escaped strings does not work at all and leads to disclosure of heap memory content. Affected versions Affected is PHP 5.2.1 Detailed information Wit...
php session extension information leak
The phpbinary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information memory contents via a serialized variable entry with a large length value, which triggers a buffer over-read...
security flaw
The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the keylength variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name befo...
USN-430-1: mod_python vulnerability
Miles Egan discovered that modpython, when used in output filter mode, did not handle output larger than 16384 bytes, and would display freed memory, possibly disclosing private data. Thanks to Jim Garrison of the Software Freedom Law Center for identifying the original bug as a security...
Plan 9 Kernel (devenv.c OTRUNC/pwrite) Local Exploit
No description provided by source. / !!! DO NOT DISTRIBUTE !!! / / identity theft this exploit uses my devenv.c OTRUNC/pwrite vulnerability to overwrite specific kernel addresses to help elevate our privileges. this exploit is very picky, so you must understand the plan9 kernel and know what you...
Plan 9 Kernel - 'devenv.c OTRUNC/pwrite' Local Privilege Escalation
/ !!! DO NOT DISTRIBUTE !!! / / identity theft this exploit uses my devenv.c OTRUNC/pwrite vulnerability to overwrite specific kernel addresses to help elevate our privileges. this exploit is very picky, so you must understand the plan9 kernel and know what you are doing, though a best-practice...
php session extension information leak
The phpbinary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information memory contents via a serialized variable entry with a large length value, which triggers a buffer over-read...
php session extension information leak
The phpbinary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information memory contents via a serialized variable entry with a large length value, which triggers a buffer over-read...
Fedora Core 5 : php-5.1.4-1 (2006-289)
This update includes the latest release of PHP 5, version 5.1.4. This release includes fixes for several security issues and many bug fixes. The phpinfo PHP function did not properly sanitize long strings. An attacker could use this to perform cross-site scripting attacks against sites that have...
MS Windows NtRaiseHardError Csrss.exe-winsrv.dll Double Free
No description provided by source. ///////////////////////////////////////// ///////////////////////////////////////// ///// Microsoft Windows NtRaiseHardError ///// Csrss.exe-winsrv.dll Double Free ///////////////////////////////////////// ///// Ruben Santamarta ///// ruben at reversemode dot co...
MS Windows NtRaiseHardError Csrss.exe-winsrv.dll Double Free
Exploit for unknown platform in category dos / poc ============================================================ MS Windows NtRaiseHardError Csrss.exe-winsrv.dll Double Free ============================================================ /////////////////////////////////////////...
MS Windows NtRaiseHardError Csrss.exe Memory Disclosure Exploit
No description provided by source. ///////////////////////////////////////// ///////////////////////////////////////// ///// Microsoft Windows NtRaiseHardError ///// Csrss.exe memory disclosure ///////////////////////////////////////// ///// Ruben Santamarta ///// ruben at reversemode dot com ///...
csrssexe.txt
Hi, I have been taking a look at the NtRaiseHardError bug and just for fun I've coded an exploit. Watch out, not for the double free vulnerability indeed I have not analyzed that piece of code yet but just relying on NtRaiseHardError internals and how is dispatched a MessageBox with...
Microsoft Windows - NtRaiseHardError Csrss.exe Memory Disclosure
Microsoft Windows - NtRaiseHardError Csrss.exe Memory Disclosure ///////////////////////////////////////// ///////////////////////////////////////// ///// Microsoft Windows NtRaiseHardError ///// Csrss.exe memory disclosure ///////////////////////////////////////// ///// Ruben Santamarta /////...
MS Windows NtRaiseHardError Csrss.exe Memory Disclosure Exploit
Exploit for unknown platform in category local exploits =============================================================== MS Windows NtRaiseHardError Csrss.exe Memory Disclosure Exploit =============================================================== /////////////////////////////////////////...