Google Android - Inter-process munmap in android.util.MemoryIntArray Vulnerability

Exploit for Android platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1001 The MemoryIntArray class allows processes to share an in-memory array of integers by transferring an ashmem file descriptor. As the class implements the Parcelable interface, ...

Google Android - android.util.MemoryIntArray Ashmem Race Conditions

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1002 The MemoryIntArray class allows processes to share an in-memory array of integers by transferring an ashmem file descriptor. As the class implements the Parcelable interface, it can be passed within a Parcel or a Bundle and...

Threat Outbreak Alert RuleID27512: Email Messages Distributing Malicious Software on January 27, 2017

Medium Alert ID: 52451 First Published: 2017 January 27 14:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID27512 may contain the following files: Name |...

Threat Outbreak Alert RuleID27412: Email Messages Distributing Malicious Software on January 26, 2017

Medium Alert ID: 52428 First Published: 2017 January 26 15:00 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID27412 may contain the following files: Name |...

Android - Inter-Process munmap with User-Controlled Size in android.graphics.Bitmap Vulnerability

Exploit for Android platform in category remote exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=928 Bitmap objects can be passed between processes by flattening them to a Parcel in one process and un-flattening them in another. In order to conserve memory, there exists ...

Google Android - Inter-Process munmap with User-Controlled Size in android.graphics.Bitmap

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=928 Bitmap objects can be passed between processes by flattening them to a Parcel in one process and un-flattening them in another. In order to conserve memory, there exists a code path which allows Bitmaps to be shared between...

Google Android '/native/libs/binder/Parcel.cpp' Security Bypass Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A security bypass vulnerability exists in Google Android '/native/libs/binder/Parcel.cpp'. The vulnerability allows attackers to bypass certain security restrictions and perform...

Google Android - Binder Generic ASLR Leak

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=889 The interaction between the kernel /dev/binder and the usermode Parcel.cpp mean that when a binder object is passed as BINDERTYPEBINDER or BINDERTYPEWEAKBINDER, a pointer to that object in the server process is leaked to the...

UBUNTU-CVE-2016-3750

libs/binder/Parcel.cpp in the Parcels Framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the return value of the dup system call, which allows attackers to bypass an isolation protection mechanism via a crafted...

PT-2016-2469

Name of the Vulnerable Software and Affected Versions Android versions 4.x through 4.4.3 Android versions 5.0.x through 5.0.1 Android versions 5.1.x through 5.1.0 Android versions 6.x before 2016-07-01 Description The issue is related to the libs/binder/Parcel.cpp file in the Parcels Framework...

Google Android - IOMX 'getConfig'/'getParameter' Information Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=711 Android: Information Disclosure in IOMX getConfig/getParameter Platform: Verified on google/razor/flo:6.0.1/MMB29O/2459718:user/release-keys Class: Information Disclosure Summary: The GETCONFIG and GETPARAMETER calls on IOMX ar...

parcel.indianrail.gov.in XSS vulnerability

Vulnerable URL: https://parcel.indianrail.gov.in/misapp/mis/login.jsp?msg=%22%3E%3CsVg/OnLOaD=prompt%28%22XSSPOSED%22%29%3E Details: Description| Value ---|--- Patched:| Yes, at 07.08.2016 Latest check for patch:| 07.08.2016 18:26 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

Android Privilege Escalation

The vulnerability of the Parcel::appendFrom function in the Android operating system is related to deficiencies in access control for certain functions. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain privileges of various applications through a specially...

CVE-2015-3845

The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of binder objects in an append operation, which allows attackers to obtain a different application's privileges via a crafted application, a...

UBUNTU-CVE-2015-3845

The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of binder objects in an append operation, which allows attackers to obtain a different application's privileges via a crafted application, a...

CVE-2015-3845

The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of binder objects in an append operation, which allows attackers to obtain a different application's privileges via a crafted application, a...

CVE-2015-3845

The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of binder objects in an append operation, which allows attackers to obtain a different application's privileges via a crafted application, a...

PT-2015-2210

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1.1 LMY48M Description The issue is related to the Parcel::appendFrom function in Android's Binder, which does not properly consider parcel boundaries during the identification of binder objects in an append...

CVE-2015-3845

The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of binder objects in an append operation, which allows attackers to obtain a different application's privileges via a crafted application, a...

CVE-2015-3845

CVE-2015-3845 affects Android Binder’s Parcel handling: the Parcel::appendFrom function in libs/binder/Parcel.cpp does not consider parcel boundaries when identifying binder objects, in Android versions before 5.1.1 LMY48M. The underlying flaw can allow a crafted application to obtain privileges ...