CVE-2012-5513

The XENMEMexchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service crash or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range...

CVE-2012-5513

CVE-2012-5513 affects Xen 4.2 and earlier where memory_exchange() did not properly validate guest memory pointers. The bug arises from using guest_handle_okay() to validate exchange extents, which checks only the 0-offset safety and not subranges, enabling a PV guest with hypervisor privileges to...

CVE-2012-5513

The XENMEMexchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service crash or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range...

CVE-2012-5513

The XENMEMexchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service crash or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range...

kernel: xen: XENMEM_exchange may overwrite hypervisor memory

The XENMEMexchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service crash or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range...

McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 - ActiveX 'GetObject()' Code Execution

McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 ActiveX Control GetObject Security Bypass Remote Code Execution Vulnerability tested against: Microsoft Windows Vista sp2 Microsoft Windows 2003 r2 sp2 Internet Explorer 7/8/9 product homepage:...

McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 - ActiveX GetObject() Code Execution

McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 - ActiveX GetObject Code Execution McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 ActiveX Control GetObject Security Bypass Remote Code Execution Vulnerability tested against: Microsoft Windows Vista sp2 Microsoft Windows 2003 r2...

PHP 5.4.0RC6 (x64) - Denial of Service

RHEL, CentOS gdb c Continuing. Program received signal SIGSEGV, Segmentation fault. 0x00007fd959ca5f9d in zendhashindexupdateornextinsert ht=0x7fd96480d508, h=0, pData=0x7fff75c47bd0, nDataSize=8, pDest=0x7fff75c47bc8, flag=1, zendfilename=0x7fd95a061b68...

CVE-2012-0267

CVE-2012-0267 : The StopModule method of the NTR ActiveX control (before version 2.0.4.8) allows remote attackers to execute arbitrary code by passing a crafted lModule parameter that dereferences an arbitrary memory address as a function pointer. This vulnerability results in remote code executi...

CVE-2012-0267

The StopModule method in the NTR ActiveX control before 2.0.4.8 allows remote attackers to execute arbitrary code via a crafted lModule parameter that triggers use of an arbitrary memory address as a function pointer...

[CAL-2011-0052]Adobe Shockwave Player Director File Parsing PAMM memory corruption vulnerability

CAL-2011-0052Adobe Shockwave Player Director File Parsing PAMM memory corruption vulnerability CAL ID: CAL-2011-0052 CVE ID: CVE-2011-2446 Discover: instruder of code audit labs of vulnhunt.com http://www.adobe.com/support/security/bulletins/apsb11-27.html 1 Affected Products ================= Te...

Remote code execution

Microsoft Internet Explorer 8 does not properly allocate and access memory, which allows remote attackers to execute arbitrary code via vectors involving a "dereferenced memory address," aka "Select Element Remote Code Execution Vulnerability."...

CVE-2011-1999: Undefined Security Weakness

Microsoft Internet Explorer 8 does not properly allocate and access memory, which allows remote attackers to execute arbitrary code via vectors involving a "dereferenced memory address," aka "Select Element Remote Code Execution Vulnerability."...

PT-2011-3538

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 8 Description A remote code execution issue exists due to improper memory allocation and access. This allows attackers to execute arbitrary code via vectors involving a dereferenced memory address, potential...

GCI Trader MetaTrader v4.2.x - Null Pointer Vulnerability

Document Title: =============== GCI Trader MetaTrader v4.2.x - Null Pointer Vulnerability Release Date: ============= 2011-08-08 Vulnerability Laboratory ID VL-ID: ==================================== 111 Product & Service Introduction: =============================== Marktführende Software im...

Design/Logic Flaw

chaniax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote attackers to cause a deni...

CVE-2011-2535

chaniax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote attackers to cause a deni...

Asterisk Multiple Channel Drivers Denial of Service (AST-2011-008 / AST-2011-009 / AST-2011-010)

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by multiple denial of service vulnerabilities : - If a remote user sends a SIP packet with a NULL, Asterisk reads data past the NULL even though the buffer is actually truncated...

FreeBSD : Asterisk -- multiple vulnerabilities (40544e8c-9f7b-11e0-9bec-6c626dd55a41)

The Asterisk Development Team reports : AST-2011-008: If a remote user sends a SIP packet containing a NULL, Asterisk assumes available data extends past the null to the end of the packet when the buffer is actually truncated when copied. This causes SIP header parsing to modify data past the end...

kernel: CAN info leak

The bcmconnect function in net/can/bcm.c aka the Broadcast Manager in the Controller Area Network CAN implementation in the Linux kernel 2.6.36 and earlier creates a publicly accessible file with a filename containing a kernel memory address, which allows local users to obtain potentially sensiti...