CVE-2007-5928

OpenBase 10.0.5 and earlier allows remote authenticated users to trigger a free of an arbitrary memory location via long strings in a SELECT statement. NOTE: this might be a buffer overflow, but it is not clear...

msdxmedia-exec.txt

Tested on:.. - Microsoft DirectX Media 6.0 SDK - Microsoft Internet Explorer 6 + all patches - Microsoft Windows XP SP2 Polish + all patches Details:.. obj.SourceUrl = "AAAA..1044..AAAA"; location.reload; Module DXTLIPI EAX 41414141 CALL DWORD PTR DS:EAX -- var shellcode = unescape"%u9090%u9090"+...

CoreHTTP 0.5.3alpha - HTTPd Remote Buffer Overflow

CoreHTTP 0.5.3alpha - HTTPd Remote Buffer Overflow / corehttpv0.5.3alpha: httpd remote buffer overflow exploit. by: vade79/v9 [email protected] fakehalo/realhalo compile: gcc xcorehttp.c -o xcorehttp syntax: ./xcorehttp -r -h host -p port corehttp homepage/url: http://corehttp.sourceforge.net/...

corehttp 0.5.3alpha (httpd) Remote Buffer Overflow Exploit

Exploit for linux platform in category remote exploits ========================================================== corehttp 0.5.3alpha httpd Remote Buffer Overflow Exploit ========================================================== / corehttpv0.5.3alpha: httpd remote buffer overflow exploit. by:...

MOPB-39-2007:PHP str_replace() Memory Allocation Integer Overflow Vulnerability

Summary When strreplace is called in a way that a single char is replaced by a long string and the single char occurs very often in the subject this will result in an integer overflow when the size of the memory buffer is calculated. The allocation of a too small buffer will result in a buffer...

VicFTPS 5.0 - CWD Remote Buffer Overflow (PoC)

VicFTPS 5.0 - CWD Remote Buffer Overflow PoC / VicFTPs Server CWD Remote Buffer Overflow Vulnerability DoS Proof of concept r0ut3r writ3r at gmail.com Thanks to: Marsu Marsupilamipowa at hotmail.fr for helping me out with this vulnerability. Greets Marsu, and Timq. Description: Sending a long...

MDKA-2005:045 : ghostscript

New ghostscript packages are now available that provide ghostscript 8.15.1 final and provide a number of bug fixes, including: A fix for vertical japanese text. A memory overflow in the 'lips4' driver was fixed. A double-free in gsdevice.c was fixed. A SEGV in the 'inferno' driver was fixed; this...

Fedora Core 4 : ImageMagick-6.2.2.0-3.fc4.2 (2006-587)

ImageMagick's DisplayImageCommand contains a heap overflow flaw. It is possible to pass an unexpanded glob to ImageMagick which will be expanded by ImageMagick and overflow heap memory. The updated package fixes this problem. Note that Tenable Network Security has extracted the preceding...

[KOffice security advisory] KOffice OLEfilter integer overflow

KOffice Security Advisory: KOffice olefilters integer overflow Original Release Date: 2006-12-04 URL: http://www.kde.org/info/security/advisory-20061204-1.txt 0. References CVE-2006-6120 1. Systems affected: KOffice 1.4.x and 1.6.0. 1.5.x releases are unaffected as well as 1.6.1 or newer. 2...

Cisco IOS GRE issue

Phenoelit Advisory wir-haben-auch-mal-was-gefunden 0815 +---- Title Cisco Systems IOS GRE decapsulation fault Authors FX [email protected] Phenoelit Group http://www.phenoelit.de Advisory http://www.phenoelit.de/stuff/CiscoGRE.txt Affected Products Cisco IOS Tested on: C3550 IOS 12.119 Cisco Bug ID...

clamav -- heap overflow vulnerability

Clamav team reports: A heap overflow vulnerability was discovered in libclamav which could cause a denial of service or allow the execution of arbitrary code. The problem is specifically located in the PE file rebuild function used by the UPX unpacker. Relevant code from libclamav/upx.c: memcpyds...

DEBIAN-CVE-2006-3082

parse-packet.c in GnuPG gpg 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service gpg crash and possibly overwrite memory via a message packet with a large length long user ID string, which could lead to an integer overflow, as demonstrated using the...

CVE-2005-2756

Apple QuickTime before 7.0.3 allows user-assisted attackers to overwrite memory and execute arbitrary code via a crafted PICT file that triggers an overflow during expansion...

CVE-2005-2756

CVE-2005-2756 corresponds to a buffer overflow in Apple QuickTime PictureViewer that allows remote code execution when processing crafted PICT data. Affected: QuickTime before 7.0.3 (Mac and Windows). Root cause: lack of input validation during decompression of compressed PICT data, causing memor...

ethereal -- multiple protocol dissectors vulnerabilities

An Ethreal Security Advisories reports: Our testing program has turned up several more security issues: The LDAP dissector could free static memory and crash. The AgentX dissector could crash. The 802.3 dissector could go into an infinite loop. The PER dissector could abort. The DHCP dissector...

[Full-disclosure] 64 bit qmail fun

Georgi Guninski security advisory 74, 2005 64 bit qmail fun Systems affected: qmail on 64 bit platforms with a lot of virtual memory 8GB Date: 6 May 2005 Legal Notice: This Advisory is Copyright c 2004 Georgi Guninski. You may not modify it and distribute it or distribute parts of it without the...

Multiple libtiff buffer overflows

Multiple dynami memory overflows...

BitchX 1.0c19 - Local Privilege Escalation

// BitchX local-root by Sha0 version 1.0c19 e inferiores -todas- // este exploit se lo dedico a mi chica. // 0xC0000000-4-strlenargv1-1-strlenbuffer // 2052 to the ret include include include include char payload69; char sha0code = "\xeb\x16\x5b\x31\xc0" "\x50\x53\xb0\x0b\x89"...

Debian DSA-324-1 : ethereal - several vulnerabilities

Several of the packet dissectors in ethereal contain string handling bugs which could be exploited using a maliciously crafted packet to cause ethereal to consume excessive amounts of memory, crash, or execute arbitrary code. These vulnerabilities were announced in the following Ethereal security...

Mandrake Linux Security Advisory : apache2 (MDKSA-2004:064)

A Denial of Service Dos condition was discovered in Apache 2.x by George Guninski. Exploiting this can lead to httpd consuming an arbitrary amount of memory. On 64bit systems with more than 4GB of virtual memory, this may also lead to a heap-based overflow. The updated packages contain a patch fr...