Linux Kernel "mremap()"#2 Local Proof-of-concept

Exploit for linux platform in category local exploits ================================================ Linux Kernel "mremap"2 Local Proof-of-concept ================================================ / Proof-of-concept exploit code for domremap 2 Copyright C 2004 Christophe Devine This program is...

Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator

/ Proof-of-concept exploit code for domremap 2 EDB Note: This is NOT to be confused with CVE-2003-0985 // https://www.exploit-db.com/exploits/141/, which would be "domremap 1". EDB Note: This will just "test" the vulnerability. A exploit version can be found here...

[Full-Disclosure] Second critical mremap() bug found in all Linux kernels

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Synopsis: Linux kernel domremap VMA limit local privilege escalation vulnerability Product: Linux kernel Version: 2.2 up to 2.2.25, 2.4 up to 2.4.24, 2.6 up to 2.6.2 Vendor: http://www.kernel.org/ URL:...

DSA-441 linux-kernel-2.4.17-mips+mipsel - missing function return value check

Bulletin has no description...

DSA-438 linux-kernel-2.4.18-alpha+i386+powerpc - missing function return value check

Bulletin has no description...

Linux kernel do_mremap() local privilege escalation vulnerability

Background The Linux kernel is responsible for memory management in a working system - to allow this, processes are allowed to allocate and unallocate memory. Description The memory subsystem allows for shrinking, growing, and moving of chunks of memory along any of the allocated memory areas whi...

[Full-Disclosure] Linux kernel mremap vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Synopsis: Linux kernel domremap local privilege escalation vulnerability Product: Linux kernel Version: 2.2, 2.4 and 2.6 series Vendor: http://www.kernel.org/ URL: http://isec.pl/vulnerabilities/isec-0012-mremap.txt CVE:...

[Full-Disclosure] [iSEC] Linux kernel do_brk() lacks argument bound checking

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Synopsis: Linux kernel dobrk lacks argument bound checking Product: Linux Version: up to 2.4.23, others Vendor: http://www.kernel.org/ URL: http://isec.pl/vulnerabilities/isec-0012-dobrk.txt CVE:...

Microsoft Windows - DCOM RPC2 Universal Shellcode

MS Windows DCOM RPC2 Universal Shellcode. Shellcode exploit for win32 platform ; Segment type: Pure code ;seg000 segment byte public 'CODE' use32 ; assume cs:seg000 ; assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing .386 assume cs:seg000 var29C = byte ptr -29Ch var28C = byte ptr...

Sendmail fails to appropriately initialize data structures for DNS maps

Overview There is an uninitialized data structure in sendmail 8.12.x rrdomain = smstrduphost; \t\tif rr-rrdomain == NULL \t\t A fix for this condition was made in sendmail 8.12.9 in March 2003, but it was not known to be a security issue at that time. --- Impact A remote attacker may be able to...

OpenBSD 3.3 - Semget() Integer Overflow (2)

OpenBSD 3.3 - Semget Integer Overflow 2 // source: https://www.securityfocus.com/bid/8464/info A vulnerability has been discovered in the OpenBSD semget system call. The problem occurs due to insufficient sanity checks before allocating memory using the user-supplied nsems value as an argument. A...

Microsoft Security Bulletin MS03-029: Flaw in Windows Function Could Allow Denial of Service (Q823803)

-----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- Title: Flaw in Windows Function Could Allow Denial of Service 823803 Date: 23 July 2003 Software: Microsoft Windows NT 4.0 Server Impact: Denial of service Max Risk: Moderate Bulletin:...

EType EServ 2.98/2.99/3.0 - Resource Exhaustion (Denial of Service) (1)

source: https://www.securityfocus.com/bid/7552/info A denial of service vulnerability has been reported for EServ. The vulnerability exists due to the way the server handles connections. Specifically, memory allocated for open connections are not properly freed when a connection no longer exists...

Mod_NTLM 0.x - Authorisation Heap Overflow

source: https://www.securityfocus.com/bid/7388/info The modntlm Apache module has been reported prone to a heap overflow vulnerability. The vulnerability occurs due to a lack of sufficient bounds checking performed on user-supplied data, stored in heap memory. By supplying excessive data an...

Multiple cgihtml vulnerabilities

Overview -------- cgihtml is a collection of routines for parsing World Wide Web WWW Common Gateway Interface CGI input and outputting HyperText Markup Language HTML. http://www.eekim.com/software/cgihtml/ According to the authors website, it has potentially been used in the implementation of...

DEBIAN-CVE-2002-0847

tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice double-free...

EEYE: Sun(TM) ONE / iPlanet Web Server 4.1 and 6.0 Remote Buffer Overflow

SunTM ONE / iPlanet Web Server 4.1 and 6.0 Remote Buffer Overflow Release Date: August 8, 2002 Severity: High Remote SYSTEM/ROOT Systems Affected: iPlanet 6.0 and prior Description: A vulnerability in transfer chunking can be exploited to remotely execute code of an attacker's choice on a...

DSA-145 tinyproxy - doubly freed memory

Bulletin has no description...

PHP fails to properly parse the headers of HTTP POST requests

Overview A vulnerability has been discovered in PHP. This vulnerability could be used by a remote attacker to execute arbitrary code or crash PHP and/or the web server. Description PHP is a popular scripting language in widespread use. For more information about PHP, see...

CVE-2002-0059

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once a "double free", which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data...