Off-by-one Write Vulnerability

WolfSSL, formerly known as cyassl, is vulnerable to an off-by-one write vulnerability. This vulnerability in the x509 certificate parsing allows attackers to use an x509 certificate to cause denial of service DoS conditions and possibly remote code execution through a single out of bounds overwri...

wolfSSL 3.10.2 - x509 Certificate Text Parsing Off-by-One

Exploit for multiple platform in category dos / poc WOLFSSL LIBRARY X509 CERTIFICATE TEXT PARSING CODE EXECUTION VULNERABILITY MAY 8, 2017 CVE-2017-2800 SUMMARY An exploitable off-by-one write vulnerability exists in the x509 certificate parsing functionality of wolfSSL library versions up to...

wolfSSL 3.10.2 - x509 Certificate Text Parsing Off-by-One

wolfSSL 3.10.2 - x509 Certificate Text Parsing Off-by-One TALOS-2017-0293 WOLFSSL LIBRARY X509 CERTIFICATE TEXT PARSING CODE EXECUTION VULNERABILITY MAY 8, 2017 CVE-2017-2800 SUMMARY An exploitable off-by-one write vulnerability exists in the x509 certificate parsing functionality of wolfSSL...

WolfSSL library X509 Certificate Text Parsing Code Execution Vulnerability

Summary An exploitable off-by-one write vulnerability exists in the x509 certificate parsing functionality of wolfSSL library versions up to 3.10.2. A specially crafted x509 certificate can cause a single out of bounds byte overwrite resulting in potential certificate validation vulnerabilities,...

CVE-2016-7513

Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service segmentation fault via unspecified vectors...

CVE-2016-7513

Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service segmentation fault via unspecified vectors...

Code injection

Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service segmentation fault via unspecified vectors...

CVE-2016-7513

Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service segmentation fault via unspecified vectors...

DEBIAN-CVE-2016-7513

Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service segmentation fault via unspecified vectors...

kernel: Off-by-one error in selinux_setprocattr (/proc/self/attr/fscreate)

A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files. An empty null write to this file can crash the system by causing the system to attempt to access unmapped kernel memory...

kernel: Off-by-one error in selinux_setprocattr (/proc/self/attr/fscreate)

A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files. An empty null write to this file can crash the system by causing the system to attempt to access unmapped kernel memory...

CVE-2017-7301

The Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, has an aoutlinkaddsymbols function in bfd/aoutx.h that has an off-by-one vulnerability because it does not carefully check the string offset. The vulnerability could lead to a GNU linker ld program crash...

macOS Kernel 10.12.3 (16D32) - audit_pipe_open Off-by-One Memory Corruption Exploit

Exploit for macOS platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1126 MacOS kernel memory corruption due to off-by-one in auditpipeopen auditpipeopen is the special file open handler for the auditpipe device major number 10. Here's the code:...

Apple macOSiOS Kernel 10.12.3 (16D32) - SIOCGIFORDER Socket ioctl Off-by-One Memory Corruption

Apple macOSiOS Kernel 10.12.3 16D32 - SIOCGIFORDER Socket ioctl Off-by-One Memory Corruption / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1111 SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the ifnetorderedhead linked list of interfaces...

MacOS/iOS kernel memory corruption due to off-by-one in SIOCGIFORDER socket ioctl (CVE-2017-2474)

SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the ifnetorderedhead linked list of interfaces. SIOCSIFORDER clears the existing list and allows userspace to specify an array of interface indexes used to build a new list. SIOCGIFORDER allow userspace to query the list...

MacOS kernel memory corruption due to off-by-one in audit_sdev_open (CVE-2017-2483)

The auditsession device has a copy-pasted version of the same bug as the auditpipe device: static int auditsdevopendevt dev, unused int flags, unused int devtype, proct p struct auditsdev asdev; struct auditinfoaddr aia; int u; u = minordev; if u MAXAUDITSDEVS return ENXIO; void auditsdevgetaiap,...

macOS / iOS Kernel 10.12.3 (16D32) - SIOCGIFORDER Socket ioctl Off-by-One Memory Corruption

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1111 SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the ifnetorderedhead linked list of interfaces. SIOCSIFORDER clears the existing list and allow...

Apple macOS Kernel 10.12.3 (16D32) - 'audit_pipe_open' Off-by-One Memory Corruption

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1126 MacOS kernel memory corruption due to off-by-one in auditpipeopen auditpipeopen is the special file open handler for the auditpipe device major number 10. Here's the code: static int auditpipeopendevt dev, unused int flags,...

Apple macOS/iOS Kernel 10.12.3 (16D32) - SIOCGIFORDER Socket ioctl Off-by-One Memory Corruption

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1111 SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the ifnetorderedhead linked list of interfaces. SIOCSIFORDER clears the existing list and allows userspace to specify an array of interface indexes...

Apple macOS Kernel 10.12.3 (16D32) - audit_pipe_open Off-by-One Memory Corruption

Apple macOS Kernel 10.12.3 16D32 - auditpipeopen Off-by-One Memory Corruption / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1126 MacOS kernel memory corruption due to off-by-one in auditpipeopen auditpipeopen is the special file open handler for the auditpipe device major...