kav60-escalate.txt

// kav 6.0 0day local priv escalation exploit // by m4d // http://unl0ck.net include include include // r0-shellcode creates C:\Hello.txt with "Hello from ring-0! :" unsigned char Shellcode405 = 0x55, 0x8B, 0xEC, 0x83, 0xC4, 0xBC, 0x60, 0x83, 0x4D, 0xE8, 0xFF, 0x0F, 0x01, 0x4D, 0xFA, 0x8B, 0x4D,...

CVE-2006-6499

The jsdtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to cause a denial of service via any plugins tha...

DEBIAN-CVE-2006-6499

The jsdtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to cause a denial of service via any plugins tha...

CVE-2006-6499

The jsdtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to cause a denial of service via any plugins tha...

CVE-2006-6499

The jsdtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to cause a denial of service via any plugins tha...

CVE-2006-6499

The jsdtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to cause a denial of service via any plugins tha...

CVE-2006-6499

The CVE-2006-6499 entry concerns Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The vulnerability is a memory overwrite that occurs when floating-point precision is reduced, rather than exiting safely. This can allow remot...

PT-2006-7103 · Mozilla +1 · Firefox +3

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 2.x before 2.0.0.1 Mozilla Firefox versions 1.5.x before 1.5.0.9 Thunderbird versions before 1.5.0.9 SeaMonkey versions before 1.0.7 Description: The js dtoa function overwrites memory instead of exiting when the...

Microsoft Word Document Code Execution Proof of Concept

No description provided by source. ===== The file I have attached is a very basic two stage bug. stage 1 the first mod forces the code down a wrong path. the second mod by itsself is harmless, however when used with the first it will be the first and part of the second overwrite. I have use...

CVE-2003-1310

The CVE concerns Norton AntiVirus 2002 on Windows, specifically the DeviceIoControl path in the Norton Device Driver (NAVAP.sys). The vulnerability allows local privilege escalation by overwriting memory locations through certain IOCTL codes, enabling a non-privileged user to gain higher privileg...

CVE-2003-1310: Undefined Security Weakness

The DeviceIoControl function in the Norton Device Driver NAVAP.sys in Symantec Norton AntiVirus 2002 allows local users to gain privileges by overwriting memory locations via certain control codes aka "Device Driver Attack"...

CVE-2006-5379

CVE-2006-5379 affects NVIDIA Binary Graphics Driver (the binary blob driver) for Linux, specifically v8774 and v8762, with the accelerated rendering path for font glyphs. The vulnerability arises from improper handling of very large font glyph width values, enabling an attacker to corrupt memory ...

CVE-2006-5379

The accelerated rendering functionality of NVIDIA Binary Graphics Driver binary blob driver For Linux v8774 and v8762, and probably on other operating systems, allows local and remote attackers to execute arbitrary code via a large width value in a font glyph, which can be used to overwrite...

CVE-2006-5379

The accelerated rendering functionality of NVIDIA Binary Graphics Driver binary blob driver For Linux v8774 and v8762, and probably on other operating systems, allows local and remote attackers to execute arbitrary code via a large width value in a font glyph, which can be used to overwrite...

CVE-2006-5379

The accelerated rendering functionality of NVIDIA Binary Graphics Driver binary blob driver For Linux v8774 and v8762, and probably on other operating systems, allows local and remote attackers to execute arbitrary code via a large width value in a font glyph, which can be used to overwrite...

CVE-2006-5379: Undefined Security Weakness

The accelerated rendering functionality of NVIDIA Binary Graphics Driver binary blob driver For Linux v8774 and v8762, and probably on other operating systems, allows local and remote attackers to execute arbitrary code via a large width value in a font glyph, which can be used to overwrite...

NVIDIA binary graphics driver: Privilege escalation vulnerability

The accelerated rendering functionality of NVIDIA Binary Graphics Driver binary blob driver For Linux v8774 and v8762, and probably on other operating systems, allows local and remote attackers to execute arbitrary code via a large width value in a font glyph, which can be used to overwrite...

Debian DSA-1107-1 : gnupg - integer overflow

Evgeny Legerov discovered that gnupg, the GNU privacy guard, a free PGP replacement contains an integer overflow that can cause a segmentation fault and possibly overwrite memory via a large user ID string. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

Debian DSA-943-1 : perl - integer overflow

Jack Louis discovered an integer overflow in Perl, Larry Wall's Practical Extraction and Report Language, that allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via specially crafted content that is passed to vulnerable format strings of third-party software. The...

Debian DSA-1115-1 : gnupg2 - integer overflow

Evgeny Legerov discovered that gnupg, the GNU privacy guard, a free PGP replacement contains an integer overflow that can cause a segmentation fault and possibly overwrite memory via a large user ID string. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...