9289 matches found
shopify-scripts: SIGSEGV - kh_resize_iv - Null Deref
PoC --------------------- The following code triggers the bug attached as khresizeiv.rb: l t'',''doend s'',''do.end d t''do.end a=Array.new a.=102,0 € s a.tos a a.tos a.i Debug - mirb --------------------- gdb r khresizeiv.rb Starting program: /home/x/Desktop/research/mruby/bin/mirb khresizeiv.rb...
w3m denial of service vulnerability (CNVD-2016-13131)
w3m is an open source text-based Web browser . A security vulnerability exists in versions of w3m prior to 0.5.3-33. A remote attacker can exploit this vulnerability to cause a denial of service segmentation error and crash with the help of specially crafted HTML pages...
w3m denial of service vulnerability (CNVD-2016-13132)
w3m is an open source text-based Web browser . A security vulnerability exists in versions of w3m prior to 0.5.3-33. A remote attacker can exploit this vulnerability to cause a denial of service segmentation error and crash with the help of specially crafted HTML pages...
shopify-scripts: Null pointer dereference in mrb_str_prepend
PoC ruby String.new.prepend"" Cause This crash is caused by null dereference in https://github.com/mruby/mruby/blob/master/mrbgems/mruby-string-ext/src/string.cL474 Test $ gdb -q --args ./bin/mruby test4.rb Reading symbols from ./bin/mruby...done. gdb r Starting program:...
F5 Networks BIG-IP : PHP vulnerability (K35240323)
The xmlparseintostruct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service buffer under-read and segmentation fault or possibly have unspecified other impact via crafted XML data in the second argument,...
Debian DLA-749-1 : php5 security update (httpoxy)
CVE-2016-5385 PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's...
shopify-scripts: Heap Overflow in mrb_arb_splice
It's similar with 192235, but the root cause is different. both of mruby and mruby-engine are crashed by the following PoC. MRBINT64 ruby ary = Array.new1023 ary0x7ffffffffffffc00,0 = Array.new1024 $ gdb -q --args ./bin/mruby test2.rb Reading symbols from ./bin/mruby...done. gdb r Starting progra...
shopify-scripts: Integer Overflow in mrb_ary_set
Hi, I found a crash in mruby. I frankly couldn't reproduce it in mruby-engine. I think it is because of memory limitation, but I'm not sure. Here is a PoC when the size of MRBINT is 32. ruby ary = Array.new0 ary0x7fffffff = 1 $ gdb -q --args ./bin/mruby ./test.rb Reading symbols from...
shopify-scripts: SIGSEGV mrb_obj_freeze() Manipulating Register RAX and RSI
There is an invalid memory read on mruby when calling to mrbobjfreeze with a invalid "Struct RBasic" which causes a SIGSEGV and leads to denial of service or remote. The following code triggers the bug attached as mrbobjfreeze.rb: o=0x30303030.freeze Crash --------------------- Here we can see th...
CVE-2016-8612
An error was found in protocol parsing logic of modcluster load balancer Apache HTTP Server modules. An attacker could use this flaw to cause a Segmentation Fault in the serving httpd process...
mod_cluster: Protocol parsing logic error
An error was found in protocol parsing logic of modcluster load balancer Apache HTTP Server modules. An attacker could use this flaw to cause a Segmentation Fault in the serving httpd process...
Scientific Linux Security Update : ntp on SL7.x x86_64 (20161103)
Security Fixes : - It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length checks in NTP's ntpcrypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. A remote attacker coul...
CVE-2016-5841
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service segmentation fault or possibly execute arbitrary code via vectors involving the offset variable...
Integer overflow
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service segmentation fault or possibly execute arbitrary code via vectors involving the offset variable...
CVE-2016-5841
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service segmentation fault or possibly execute arbitrary code via vectors involving the offset variable...
CVE-2016-5841
CVE-2016-5841: Integer overflow in ImageMagick’s MagickCore/profile.c (offset variable) can enable a remote attacker to cause denial of service (segmentation fault) or possibly execute code. Affects ImageMagick versions before 7.0.2-1. Remediation: upgrade to ImageMagick 7.0.2-1 or later (as per ...
CVE-2016-5841
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service segmentation fault or possibly execute arbitrary code via vectors involving the offset variable...
openSUSE Security Update : pcre (openSUSE-2016-1448)
This update for pcre to version 8.39 bsc972127 fixes several issues. If you use pcre extensively please be aware that this is an update to a new version. Please make sure that your software works with the updated version. This version fixes a number of vulnerabilities that affect pcre and...
