Mozilla Foundation Security Advisory 2010-65

Mozilla Foundation Security Advisory 2010-65 Title: Buffer overflow and memory corruption using document.write Impact: Critical Announced: October 19, 2010 Reporter: Alexander Miller Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.11 Firefox 3.5.14 Thunderbird 3.1.5 Thunderbird...

Buffer overflow and memory corruption using document.write — Mozilla

Security researcher Alexander Miller reported that passing an excessively long string to document.write could cause text rendering routines to end up in an inconsistent state with sections of stack memory being overwritten with the string data. An attacker could use this flaw to crash a victim's...

Polymorphic /bin/sh x86 linux shellcode

Polymorphic /bin/sh x86 linux shellcode. Shellcode exploit for linx86 platform / Title : Polymorphic /bin/sh x86 linux shellcode . Name : 116 bytes /bin/sh x86 linux polymorphic shellcode . Date : Tue Jun 29 22:08:59 WIT 2010 . Author : gunslinger Web : http://devilzc0de.org blog :...

FreeBSD : sudo -- Secure path vulnerability (d42e5b66-6ea0-11df-9c8d-00e0815b8da8)

Todd Miller reports : Most versions of the C library function getenv return the first instance of an environment variable to the caller. However, some programs, notably the GNU Bourne Again SHell bash, do their own environment parsing and may choose the last instance of a variable rather than the...

CentOS 5 : sudo (CESA-2010:0361)

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

ZDI-10-076: Apple Preview libFontParser SpecialEncoding Remote Code Execution Vulnerability

ZDI-10-076: Apple Preview libFontParser SpecialEncoding Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-076 April 14, 2010 -- CVE ID: CVE-2010-1120 -- Affected Vendors: Apple -- Affected Products: Apple Preview -- TippingPointTM IPS Customer Protection:...

Sudo sudoedit路径解析本地权限提升漏洞

BUGTRAQ ID: 39468 CVE ID: CVE-2010-1163 Sudo是一款允许用户以其他用户权限安全的执行命令的程序，广泛使用在Linux和Unix操作系统下。...

sudo -- Privilege escalation with sudoedit

Todd Miller reports: Sudo's command matching routine expects actual commands to include one or more slash '/' characters. The flaw is that sudo's path resolution code did not add a "./" prefix to commands found in the current working directory. This creates an ambiguity between a "sudoedit" comma...

CVE-2010-1120

Unspecified vulnerability in Safari 4 on Apple Mac OS X 10.6 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by Charlie Miller during a Pwn2Own competition at CanSecWest 2010...

Design/Logic Flaw

Unspecified vulnerability in Safari 4 on Apple Mac OS X 10.6 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by Charlie Miller during a Pwn2Own competition at CanSecWest 2010...

CVE-2010-1120

Unspecified vulnerability in Safari 4 on Apple Mac OS X 10.6 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by Charlie Miller during a Pwn2Own competition at CanSecWest 2010...

CVE-2010-1120

CVE-2010-1120 is tied to an unchecked index issue in Apple Type Services’ handling of embedded fonts, allowing remote code execution in affected Apple OS X components. Publicly documented impact includes Safari 4 on Mac OS X 10.6 and Apple Preview (libFontParser.dylib) with a SpecialEncoding heap...

Charlie Miller on Pwn2Own

Charlie Miller won his third consecutive Pwn2Own contest at the CanSecWest conference in Vancouver this week. In this video he talks about the contest, the state of Apple security and the bug-finding and reporting process...

Pwn2Own Predictions: Apple iPhone Will Fall

Hackers at this year’s CanSecWest Pwn2Own contest will definitely break into an Apple iPhone by exploiting a remote code execution vulnerability. That’s the prediction from Charlie Miller and Aaron Portnoy, two security researchers who are monitoring events leading to next week’s hacker challenge...

Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability

Exploit for unknown platform in category local exploits ==================================================================== Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability ==================================================================== Vulnerable: Ubuntu Ubuntu Linux 9....

Tod Miller Sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4

No description provided by source. !/bin/sh Tod Miller Sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4 local root exploit March 2010 automated by kingcope Full Credits to Slouching echo Tod Miller Sudo local root exploit echo by Slouching echo automated by kingcope if $ != 1 then echo "usage:...

(Tod Millers) SudoSudoEdit 1.6.9p211.7.2p4 - Local Privilege Escalation

Tod Millers SudoSudoEdit 1.6.9p211.7.2p4 - Local Privilege Escalation !/bin/sh Tod Miller Sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4 local root exploit March 2010 automated by kingcope Full Credits to Slouching echo Tod Miller Sudo local root exploit echo by Slouching echo automated by...

(Tod Miller's) Sudo/SudoEdit 1.6.9p21/1.7.2p4 - Local Privilege Escalation

!/bin/sh Tod Miller Sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4 local root exploit March 2010 automated by kingcope Full Credits to Slouching echo Tod Miller Sudo local root exploit echo by Slouching echo automated by kingcope if $ != 1 then echo "usage: ./sudoxpl.sh " exit fi cd /tmp cat...

Charlie Miller on Safari Bugs, Predictions for PWN2OWN and Mobile Security

Independent Security Evaluators’ Charlie Miller discusses Safari bugs, his predictions for this year’s PWN2OWN and mobile security with Ryan Naraine at RSA 2010...

Tod Miller Sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4 Exploit

Exploit for unknown platform in category local exploits ====================================================================== Tod Miller Sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4 exploit ====================================================================== !/bin/sh Tod Miller Sudo 1.6...