FreeBSD -- posix_spawnp(3) buffer overflow

Problem Description: posixspawnp spawns a new thread with a limited stack allocated on the heap before delegating to execvp for the final execution within that thread. execvp would previously make unbounded allocations on the stack, directly proportional to the length of the user-controlled PATH...

Oracle Linux 6 : kernel (ELSA-2020-1524)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1524 advisory. - wireless rtlwifi: Fix potential overflow on P2P code Jarod Wilson 1775226 CVE-2019-17666 Tenable has extracted the preceding description block direct...

DEBIAN-CVE-2014-9630

The rtppacketizexiphconfig function in modules/streamout/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified...

Memory corruption

The rtppacketizexiphconfig function in modules/streamout/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified...

Webkit JSC: JIT - Uninitialized Variable Access in ArgumentsEliminationPhase::transform

Webkit JSC: JIT - Uninitialized Variable Access in ArgumentsEliminationPhase::transform https://github.com/WebKit/webkit/blob/94e868c940d46c5745869192d07255331d00102b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cppL743 case GetByVal: ... unsigned numberOfArgumentsToSkip = 0; if...

MasterSCADA COM Object dfact.dll Emergency Termination

The vulnerability of the COM object dfact.dll in the image processing method of the SetImage classes BmpImager, GifImager, AviImager, JpgImager in the MasterSCADA software package arises due to the use of a insecure memory allocation function on the stack allocaprobe16. Exploiting this...

Design/Logic Flaw

When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off-by-one error meant that data was written beyond the allocated space on the stack. This issue affects WhatsApp for Android starting in version 2.18.180 and w...

CVE-2018-6339

When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off-by-one error meant that data was written beyond the allocated space on the stack. This issue affects WhatsApp for Android starting in version 2.18.180 and w...

CVE-2018-6339

The CVE-2018-6339 issue affects WhatsApp for Android (v2.18.180 onward) and WhatsApp Business for Android (v2.18.103 onward). The root cause is a stack allocation off-by-one error where data is written beyond allocated space, leading to a crash. Fixes are in WhatsApp for Android v2.18.295 and Wha...

PT-2019-11019

Name of the Vulnerable Software and Affected Versions: WhatsApp for Android versions 2.18.180 through 2.18.294 WhatsApp Business for Android versions 2.18.103 through 2.18.149 Description: The issue arises from a stack allocation failure when receiving calls using WhatsApp on Android, specificall...

Router vulnerability reproduce the ultimate Upanishads--based on the MIPS shellcode writing-vulnerability warning-the black bar safety net

Foreword Today we talk about how in the MIPS architecture to write shellcode for. In the previous two articles, we were introduced based on the MIPS buffer overflow practice, and further how to use learn to the overflow of knowledge reproduction and verification of router vulnerabilities. But in...

Microsoft Edge Chakra JIT - Memory Corruption

Microsoft Edge Chakra JIT - Memory Corruption / Let's consider the following example code. function opt let arr = ; return arr'x'; // Optimize the "opt" function. for let i = 0; i inline Js::Var ExecuteImplicitCallJs::RecyclableObject function, Js::ImplicitCallFlags flags, Fn implicitCall // For...

Microsoft Edge Chakra JIT - Escape Analysis Bug Exploit

Exploit for windows platform in category dos / poc / Escape analysis: https://en.wikipedia.org/wiki/Escapeanalysis Chakra fails to detect if "tmp" escapes the scope, allocates it to the stack. This may lead to dereference uninitialized stack values. PoC: / function opt let tmp = ; tmp0 = tmp;...

Amazon Linux AMI : glibc (ALAS-2017-877)

Unbounded stack allocation in catopen function A stack based buffer overflow vulnerability was found in the catopen function. An excessively long string passed to the function could cause it to crash or, potentially, execute arbitrary code.CVE-2015-8779 Integer overflow in hcreate and hcreater An...

Medium: glibc

Issue Overview: Unbounded stack allocation in catopen function A stack based buffer overflow vulnerability was found in the catopen function. An excessively long string passed to the function could cause it to crash or, potentially, execute arbitrary code.CVE-2015-8779 Integer overflow in hcreate...

glibc: Unbounded stack allocation in catopen function

A stack based buffer overflow vulnerability was found in the catopen function. An excessively long string passed to the function could cause it to crash or, potentially, execute arbitrary code...

Oracle Linux 6 : glibc (ELSA-2017-0680)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0680 advisory. - Fix CVE-2015-8779 glibc: Unbounded stack allocation in catopen function 1358015. - Fix CVE-2015-8778 glibc: Integer overflow in hcreate and hcreater...

glibc security update

2.12-1.209.0.1 - Update newmode size to fix a possible corruption 2.12-1.209 - Fix AFINET6 getaddrinfo with nscd 1416496 2.12-1.208 - Update tests for struct sockaddrstorage changes 1338673 2.12-1.207 - Use FLCLOEXEC in internal calls to fopen 1012343. 2.12-1.206 - Fix CVE-2015-8779 glibc:...

Ubuntu: Security Advisory (USN-3239-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

glibc: Unbounded stack allocation in nan* functions

A stack overflow vulnerability was found in nan functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code...