CVE-2016-6235

The setupimginfojpg function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause a denial of service segmentation fault via a crafted jpeg file...

CVE-2016-6235

The setupimginfojpg function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause a denial of service segmentation fault via a crafted jpeg file...

shopify-scripts: Denial of service (segfault) due to null pointer dereference in mrb_vm_exec

Introduction ============ Provided PoC segfaults at mrbvmexec due to null pointer dereference. Proof of concept ================ Attached the poc. Crash report ============ ./sandbox vmexec.rb ./sandbox:20: BUG Segmentation fault at 0x00000000000000 ruby 2.3.1p112 2016-04-26 x8664-linux-gnu --...

libevent -- multiple vulnerabilities

Debian Security reports: CVE-2016-10195: The nameparse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the labellen variable, which triggers an out-of-bounds stack read. CVE-2016-10196: Stack-based buffer overflow in the...

shopify-scripts: SIGSEGV - vm.c - line:1214

PoC ------------------- The following code triggers the bug attached as testmrbvmexec1214.rb: def test instanceexec do return toenum:==end ensure end test Debug - mirb ------------------- gdb r testmrbvmexec1214.rb Starting program: /home/x/Desktop/research/3fuzz/mruby/bin/mirb testmrbvmexec1214....

SUSE-SU-2017:0304-1 Security update for gnutls

This update for gnutls fixes the following issues: - Malformed asn1 definitions could cause a segmentation fault in the asn1 definition parser bsc961491. - CVE-2016-8610: Remote denial of service in SSL alert handling bsc1005879. - CVE-2017-5335: Decoding a specially crafted OpenPGP certificate...

RHEL 6 : JBoss Core Services (RHSA-2017:0193)

Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.23 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

PHP 5.6.x < 5.6.30 Multiple DoS

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.30. It is, therefore, affected by the following vulnerabilities : - A seg fault when loading hostile phar could be used to crash the PHP interpreter or potentially disclose information due to a buff...

mod_cluster: Protocol parsing logic error

An error was found in protocol parsing logic of modcluster load balancer Apache HTTP Server modules. An attacker could use this flaw to cause a Segmentation Fault in the serving httpd process...

mod_cluster: Protocol parsing logic error

An error was found in protocol parsing logic of modcluster load balancer Apache HTTP Server modules. An attacker could use this flaw to cause a Segmentation Fault in the serving httpd process...

CVE-2016-6160

tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service segmentation fault via a large frame, a related issue to CVE-2017-14266...

Sql injection

tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service segmentation fault via a large frame, a related issue to CVE-2017-14266...

CVE-2016-6160

tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service segmentation fault via a large frame, a related issue to CVE-2017-14266...

CVE-2016-6160

CVE-2016-6160 affects tcpreplay’s tcprewrite utility; before version 4.1.2 it allows remote attackers to cause a denial of service (segmentation fault) by sending a large PCAP frame. The issue is related to CVE-2017-14266, which describes a heap-based buffer overflow in Tcpreplay 3.4.4 triggered ...

CVE-2016-6160

tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service segmentation fault via a large frame, a related issue to CVE-2017-14266...

CVE-2016-6160

tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service segmentation fault via a large frame, a related issue to CVE-2017-14266...

Ruby: Parsing invalid unicode codepoints using json c extension (2.0.1+) triggers a segfault

Using the default json library packaged with ruby, one can trigger a segmentation fault by submitting a string with a unicode escape sequence in the range between \ud800-\udbff https://en.wikipedia.org/wiki/UTF-16U.2BD800toU.2BDFFF. This is can lead to a denial of service attack by segmentation...

shopify-scripts: Crash in print_backtrace

This crash does not affect mruby-engine because it does not print the back trace in guest. We can control the register by setting a backtrace array. PoC ruby exc = Exception.new exc.setbacktrace0x41414141 raise exc GDB $ gdb -q --args ./bin/mruby test12.rb Reading symbols from ./bin/mruby...done...

shopify-scripts: Still heap overflow in mrb_ary_splice

The fix of 192362 is still crashed with a different PoC. I think the cause of this bug is the same and I missed the incomplete fix, so you may be able to skip rewards for this one. Cause If I set the tail value to a specific value, then I can maintain the array size. The original fix only checks...

shopify-scripts: SIGSEGV - mrb_vm_exec - line:1681

PoC: ------------------- The following code triggers the bug attached as testmrbvmexec1681.rb: def try yield ensure yield end a=lambda do a.try do return end end.call Mirb - Debug: ------------------- gdb r testmrbvmexec1678.rb The program being debugged has been started already. Start it from th...