Crysis 1.1.1.5879 - Remote Format String Denial of Service (PoC)

Crysis 1.1.1.5879 - Remote Format String Denial of Service PoC The Crysis engine passes along internal debug strings through the game. One of them is passed to vsprintf in the crt lib: 30503263 8D8C24 10100000 LEA ECX,DWORD PTR SS:ESP+1010 3050326A 51 PUSH ECX 3050326B 50 PUSH EAX 3050326C 8D5424...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : pcre3 vulnerability (USN-581-1)

It was discovered that PCRE did not correctly handle very long strings containing UTF8 sequences. In certain situations, an attacker could exploit applications linked against PCRE by tricking a user or automated system in processing a malicious regular expression leading to a denial of service or...

USN-581-1: PCRE vulnerability

It was discovered that PCRE did not correctly handle very long strings containing UTF8 sequences. In certain situations, an attacker could exploit applications linked against PCRE by tricking a user or automated system in processing a malicious regular expression leading to a denial of service or...

FreeBSD : xfce -- multiple vulnerabilities (024edd06-c933-11dc-810c-0016179b2dd5)

Gentoo reports : A remote attacker could entice a user to install a specially crafted 'rc' file to execute arbitrary code via long strings in the 'Name' and 'Comment' fields or via unspecified vectors involving the second vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

VB Marketing - 'tseekdir.cgi' Local File Inclusion

source: https://www.securityfocus.com/bid/27475/info VB Marketing is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability using directory-traversal strings to include local script code in the context of t...

Debian: Security Advisory (DSA-584-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 1197-1 (python2.4)

The remote host is missing an update to python2.4 announced via advisory DSA 1197-1. Benjamin C. Wiley Sittler discovered that the repr of the Python interpreter allocates insufficient memory when parsing UCS-4 Unicode strings, which might lead to execution of arbitrary code through a buffer...

Debian: Security Advisory (DSA-139)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 943-1 (perl)

The remote host is missing an update to perl announced via advisory DSA 943-1. Jack Louis discovered an integer overflow in Perl, Larry Wall's Practical Extraction and Report Language, that allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via specially crafted...

Buffer overflow

Multiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote attackers to execute arbitrary code via 1 a reply that begins with a long version string, which triggers an overflow in handlertsppkt in rtsphandlers.c; long headers that trigger overflows in 2 sendpauserequest, 3...

AST-2007-026 - SQL Injection issue in cdr_pgsql

Asterisk Project Security Advisory - AST-2007-026 +------------------------------------------------------------------------+ | Product | Asterisk | |----------------------+-------------------------------------------------| | Summary | SQL Injection issue in cdrpgsql |...

aquick-winosx.txt

Copyright C 2007 Subreption LLC. All rights reserved. Visit http://blog.subreption.com for exploit development notes. References: http://www.milw0rm.com/exploits/4648 original Microsoft Windows code http://www.milw0rm.com/exploits/4651 recent Microsoft Windows exploit From Metasploit:...

CVE-2007-6101

Ability Mail Server before 2.61 allows remote authenticated users to cause a denial of service daemon crash via 1 malformed number list ranges in unspecified IMAP commands, and possibly 2 a blank string in unspecified messages...

Ubuntu 5.04 / 5.10 / 6.06 LTS : python2.3, python2.4 vulnerability (USN-359-1)

Benjamin C. Wiley Sittler discovered that Python's repr function did not properly handle UTF-32/UCS-4 strings. If an application uses repr on arbitrary untrusted data, this could be exploited to execute arbitrary code with the privileges of the python application. Note that Tenable Network Securi...

Ubuntu 5.04 / 5.10 / 6.06 LTS : binutils vulnerability (USN-292-1)

CVE-2006-2362 Jesus Olmos Gonzalez discovered a buffer overflow in the Tektronix Hex Format TekHex backend of the BFD library, such as used by the 'strings' utility. By tricking an user or automated system into processing a specially crafted file with 'strings' or a vulnerable third-party...

PT-2007-6861 · Openbase · Openbase

Name of the Vulnerable Software and Affected Versions: OpenBase versions 10.0.5 and earlier Description: The issue allows remote authenticated users to trigger a free of an arbitrary memory location via long strings in a SELECT statement. It is unclear if this is a buffer overflow. Recommendation...

Ubuntu 6.06 LTS / 6.10 : evolution vulnerability (USN-442-1)

Ulf Harnhammar of Secunia Research discovered that Evolution did not correctly handle format strings when displaying shared memos. If a remote attacker tricked a user into viewing a specially crafted shared memo, they could execute arbitrary code with user privileges. Note that Tenable Network...

Ubuntu 5.04 / 5.10 / 6.06 LTS : mutt vulnerability (USN-307-1)

TAKAHASHI Tamotsu discovered that mutt's IMAP backend did not sufficiently check the validity of namespace strings. If an user connects to a malicious IMAP server, that server could exploit this to crash mutt or even execute arbitrary code with the privileges of the mutt user. Note that Tenable...

Fedora 7 : vavoom-1.24-3.fc7 (2007-1977)

Security update fixing various format strings vulnerabilities and a DOS vulnerability in the vavoom server, this fixes: CVE-2007-4533, CVE-2007-4534 & CVE-2007-4535. Also see bugzilla bug 256621. Note that Tenable Network Security has extracted the preceding description block directly from the...

CVE-2002-2402

SURECOM broadband router EP-4501 uses a default SNMP read community string of "public" and a default SNMP read/write community string of "secret," which allows remote attackers to read and modify router configuration information...