144 matches found
shopify-scripts: SIGABRT - method_missing - mark_context_stack
PoC ------------------- The following code triggers the bug attached as testmethodmissing.rb: def methodmissinge,0.n||=0 00end b Debug - mirb ------------------- gdb r testmethodmissing.rb Starting program: /home/x/Desktop/research/test/mruby/bin/mirb testmethodmissing.rb mirb - Embeddable...
shopify-scripts: SIGABRT - mrb_realloc_simple - gc.c - line:201
Explain ------------------ I downloaded "mruby-master" on 14/01/2017. PoC ------------------- The following code triggers the bug attached as memorycorruption.rb: d b = Hash.new |s,k| sk 1 Crash - mirb - mruby ------------------- x@x:/Desktop/research/mruby/bin$ ./mirb memorycorruption.rb mirb -...
shopify-scripts: SIGABRT - mrb_default_allocf
POC a=b=c= a=..t=c t %W=0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0= output ----------------------------------registers----------------------------------- EAX: 0x0 EBX: 0x2 ECX: 0xbfffe4a0 -- 0x0 EDX: 0x0 ESI: 0x8 EDI: 0x0 EBP:...
shopify-scripts: SIGABRT, SIGSEGV mspace_free() and mrb_default_allocf()
Sample - 1 --------------------- The following code triggers the bug attached as mirbuseafterfree.rb: def methodmissingm"0000000"end m0=w.instanceevalprependm m0.instanceevalprependm0 Crash - Use After Free --------------------- gdb r useafterfree Starting program:...
shopify-scripts: Incorrect code generation when result of NODE_NEGATE is not used
Introduction ============ Not using the result of NODENEGATE leads to incorrect code generation which could possibly result in arbitrary bytecode generation. Currently it is possible to produce a crash through a SIGABRT via an assert failure. Proof of concept ================ assertfailure.rb...
shopify-scripts: Exception cause SIGABRT
Overriding the tos method of an exception and raise it from a sandboxed mruby evaluation result in a abort call from mruby. This results with the whole ruby process terminating. Tested on 4cd4dfc855f0cce18b1ee2f318927c13edb20d14 POC poc.rb class A 2 0x00007fe2ac234bbc in mrbexcraise...
Wireshark 1.12.0 1.12.12 2.0.0 2.0.4 - RLC Dissector Denial of Service
Wireshark 1.12.0 1.12.12 2.0.0 2.0.4 - RLC Dissector Denial of Service Sample PCAP Build Information: TShark Wireshark 2.0.2 SVN Rev Unknown from unknown Copyright 1998-2016 Gerald Combs and contributors. License GPLv2+: GNU GPL version 2 or later This is free software; see the source for copying...
Wireshark - alloc_address_wmem Assertion Failure
Wireshark - allocaddresswmem Assertion Failure Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=804 The following crash due to an asserion failure can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark -nVxr...
Mageia: Security Advisory (MGASA-2015-0374)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
MGASA-2015-0374 Updated openldap package fixes security vulnerability
By sending a crafted packet, an attacker can cause the OpenLDAP daemon to crash with a SIGABRT. This is due to an assert call in the bergetnext method in a/libraries/liblber/io.c that is hit when decoding tampered BER data CVE-2015-6908...
Updated openldap package fixes security vulnerability
By sending a crafted packet, an attacker can cause the OpenLDAP daemon to crash with a SIGABRT. This is due to an assert call in the bergetnext method in a/libraries/liblber/io.c that is hit when decoding tampered BER data CVE-2015-6908...
OpenLDAP 2.4.42 - ber_get_next Denial of Service Vulnerability
OpenLDAP versions 2.4.42 and below suffer from a remote denial of service vulnerability. Exploit Title: OpenLDAP 2.4.42 bergetnext DOS Date: 11/09/15 Exploit Author: Denis Andzakovic Vendor Homepage: http://www.openldap.org/ Software Link:...
openldap: denial of service
By sending a crafted packet, an attacker can cause the OpenLDAP daemon to crash with a SIGABRT. This is due to an assert call within the bergetnext method io.c line 682 that is hit when decoding tampered BER data. The following proof of concept exploit can be used to trigger the condition: echo...
OpenLDAP 2.4.42 - ber_get_next Denial of Service
Exploit Title: OpenLDAP 2.4.42 bergetnext DOS Date: 11/09/15 Exploit Author: Denis Andzakovic - Security-Assessment.com Vendor Homepage: http://www.openldap.org/ Software Link: ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.42.tgz Version: Y Y \ / /| / \ /||| / / /.-. / /:wq...
NetBSD <= 5.0.1 'IRET' General Protection Fault Handling Local Privilege Escalation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/36430/info NetBSD is prone to a local privilege-escalation vulnerability. A local attacker may exploit this issue to cause the kernel stack to become desynchronized. This may allow the attacker to gain elevated privileges...
Varnish 2.1.5, 3.0.3 DoS in http_GetHdr() while parsing Vary header
httpGetHdr | l == strlenhdr + 1 Authors: 22733db72ab3ed94b5f8a1ffcde850251fe6f466 c8e74ebd8392fda4788179f9a02bb49337638e7b AKAT-1 Versions: 3.0.3, 2.1.5 Summary: It's possible to crash Varnish via assertion if the single header within the Vary header is longer then 127 bytes. The 'l' cachehttp.c2...
Aircrack-NG Tools svn r1675 Remote Exploit
Exploit for multiple platform in category dos / poc ========================================== Aircrack-NG Tools svn r1675 Remote Exploit ========================================== !/usr/bin/env python -- coding: UTF-8 -- ''' A remote-exploit against the aircrack-ng tools. Tested up to svn r1675...
NetBSD 5.0.1 - 'IRET' General Protection Fault Handling Privilege Escalation
/ source: https://www.securityfocus.com/bid/36430/info NetBSD is prone to a local privilege-escalation vulnerability. A local attacker may exploit this issue to cause the kernel stack to become desynchronized. This may allow the attacker to gain elevated privileges or may aid in further attacks. ...
Konqueror 4.1 XSS / Remote Crash Vulnerabilities
No description provided by source. +-----------------------------------------------------+ | Konqueror 4.1 XSS / Remote Crash Vulnerabilities | +-----------------------------------------------------+ | by athos - stakerathotmaildotit | | http://konqueror.kde.org |...
PHP rfc822_write_address()函数缓冲区溢出漏洞
BUGTRAQ ID: 29829 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的phpimap.c文件中的rfc822writeaddress函数将返回地址列表的全部长度限定在16383字节，但没有考虑缓冲区大小。如果用户在To:或Cc:字段提供了超长的地址列表的话，就可能触发缓冲区溢出，导致PHP出现SIGABRT而崩溃。 PHP 5.2.6 PHP --- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.php.net...