92 matches found
Code injection
NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible...
CVE-2015-0565
CVE-2015-0565 corresponds to a rowhammer memory‑disturbance bug where NaCl and related x86 code could cause cache interactions (via CLFLUSH) to trigger bit flips in DRAM, enabling rowhammer-based exploits. The Connected documents describe two notable exploits: (1) NaCl sandbox escape by abusing b...
CVE-2015-0565
NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible...
CVE-2015-0565
NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible...
CVE-2015-0565: Improper Restriction of Operations within the Bounds of a Memory Buffer
NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible...
PT-2020-7796
Name of the Vulnerable Software and Affected Versions: NaCl affected versions not specified Description: The issue allows rowhammer attacks to be possible due to NaCl permitting the CLFLUSH instruction in 2015. Recommendations: At the moment, there is no information about a newer version that...
PYSEC-2018-35
aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...
AWS Auditing & Hardening Tool: Zeus
Zeus is a powerful tool for AWS EC2 / S3 / CloudTrail / CloudWatch / KMS best hardening practices. It checks security settings according to the profiles the user creates and changes them to recommended settings based on the CIS AWS Benchmark source at request of the user. Identity and Access...
[SECURITY] Fedora 26 Update: chromium-native_client-58.0.3029.81-1.20170421gitc948e9b.fc26
Google's "pnacl" toolchain for native client support in Chromium. Depends on their older "nacl" toolchain, packaged separately...
[SECURITY] Fedora 24 Update: chromium-native_client-54.0.2840.59-1.20161013git090f907.fc24
Google's "pnacl" toolchain for native client support in Chromium. Depends on their older "nacl" toolchain, packaged separately...
Open Source Distributed Secure Skype Alternative: Tox Messenger
Open Source Distributed Secure Skype Alternative Distributed FOSS secure messenger with audio and video chat capabilities Tox began a few years ago, in the wake of Edward Snowden’s leaks regarding NSA spying activity. The idea was to create an instant messaging protocol that ran without any kind ...
Vuvuzela - Private Messaging System That Hides Metadata
Vuvuzela is a messaging system that protects the privacy of message contents and message metadata. Users communicating through Vuvuzela do not reveal who they are talking to, even in the presence of powerful nation-state adversaries. Our SOSP 2015 paper explains the system, its threat model,...
Private Messaging System: Vuvuzela
Vuvuzela is a messaging system that protects the privacy of message contents and message metadata. Users communicating through Vuvuzela do not reveal who they are talking to, even in the presence of powerful nation-state adversaries. Vuvuzela is the first system that provides strong metadata...
Google Chrome < 42.0.2311.90 Multiple Vulnerabilities
Binary data 8778.pasl...
Google Chrome memory corruption vulnerability (CNVD-2015-02654)
Google Chrome is a web browser developed by the American company Google Google. Google Chrome versions prior to 42.0.2311.90, the function NaClSandbox::InitializeLayerTwoSandbox within components/nacl/loader/sandboxlinux/naclsandboxlinux.cc Failure to apply RLIMITAS and RLIMITDATA restrictions to...
CVE-2015-3335
The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandboxlinux/naclsandboxlinux.cc in Google Chrome before 42.0.2311.90 does not have RLIMITAS and RLIMITDATA limits for Native Client aka NaCl processes, which might make it easier for remote attackers to conduct...
CVE-2015-3335
The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandboxlinux/naclsandboxlinux.cc in Google Chrome before 42.0.2311.90 does not have RLIMITAS and RLIMITDATA limits for Native Client aka NaCl processes, which might make it easier for remote attackers to conduct...
CVE-2015-3335: Undefined Security Weakness
The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandboxlinux/naclsandboxlinux.cc in Google Chrome before 42.0.2311.90 does not have RLIMITAS and RLIMITDATA limits for Native Client aka NaCl processes, which might make it easier for remote attackers to conduct...
Rowhammer - NaCl Sandbox Escape
Rowhammer - NaCl Sandbox Escape Sources: http://googleprojectzero.blogspot.ca/2015/03/exploiting-dram-rowhammer-bug-to-gain.html https://code.google.com/p/google-security-research/issues/detail?id=284 Full PoC:...
Rowhammer - NaCl Sandbox Escape
Sources: http://googleprojectzero.blogspot.ca/2015/03/exploiting-dram-rowhammer-bug-to-gain.html https://code.google.com/p/google-security-research/issues/detail?id=284 Full PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36311.tar.gz This is a proof-of-conce...