Design/Logic Flaw

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler where a missing permissions check may allow users to gain access to arbitrary physical system memory, which may lead to an escalation of privileges...

CVE-2017-6251

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler where a missing permissions check may allow users to gain access to arbitrary physical system memory, which may lead to an escalation of privileges...

CVE-2017-6251

CVE-2017-6251 affects the NVIDIA Windows GPU Display Driver, specifically the kernel mode layer handler (nvlddmkm.sys). The root cause is a missing permissions check, allowing a user to access arbitrary physical system memory and potentially escalate privileges. Public connected documentation con...

CVE-2017-11613

In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, tdimagelength is not checked. The value of tdimagelength can be directly controlled by an input file. In the...

Input validation

In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, tdimagelength is not checked. The value of tdimagelength can be directly controlled by an input file. In the...

CVE-2017-11613

In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, tdimagelength is not checked. The value of tdimagelength can be directly controlled by an input file. In the...

CVE-2017-11613

CVE-2017-11613 affects LibTIFF (4.0.8) and is described as a denial-of-service in TIFFOpen. The vulnerability stems from not checking td_imagelength during ChopUpSingleUncompressedStrip, allowing an input-controlled length near system memory to hang the system or trigger the OOM killer via _TIFFC...

KLA11072 Multiple vulnerabilities in Wireshark

Multiple serious vulnerabilities have been found in Wireshark. Malicious users can exploit these vulnerabilities to cause a denial of service. Below is a complete list of vulnerabilities: 1. Multiple unspecified vulnerabilities in the AMQP and MQ dissectors can be exploited remotely via a special...

CVE-2017-9350

In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-opensafety.c by checking for a negative length...

Design/Logic Flaw

Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53-D40, 15.1X53 prior to 15.1X53-D40, 15.1 prior to 15.1R2, do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from...

grant transfer allows PV guest to elevate privileges

ISSUE DESCRIPTION The GNTTABOPtransfer operation allows one guest to transfer a page to another guest. The internal processing of this, however, does not include zapping the previous type of the page being transferred. This makes it possible for a PV guest to transfer a page previously used as pa...

x86: 64bit PV guest breakout via pagetable use-after-mode-change

ISSUE DESCRIPTION 64-bit PV guests typically use separate root page tables for their kernel and user modes. Hypercalls are accessible to guest kernel context only, which certain hypercall handlers make assumptions on. The IRET hypercall replacing the identically name CPU instruction is used by...

UBUNTU-CVE-2016-5349

The high level operating systems HLOS was not providing sufficient memory address information to ensure that secure applications inside Qualcomm Secure Execution Environment QSEE only write to legitimate memory ranges related to the QSEE secure application's HLOS client. When secure applications...

xen-kernel -- broken check in memory_exchange() permits PV guest breakout

The Xen Project reports: The XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays. A malicious or buggy 64-bit PV guest may be able to access all of system memory, allowing fo...

Xen Guest Destruction Memory Leak DoS (XSA-207)

According to its self-reported version number, the Xen hypervisor installed on the remote host is missing a security update. It is, therefore, affected by a memory leak issue due to improper cleanup during guest destruction. A guest attacker can exploit this issue, via frequent rebooting, to...

MGASA-2016-0359 Updated java-1.8.0-openjdk packages fix security vulnerability

It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions CVE-2016-5582...

Kaspersky Internet Security Denial of Service Vulnerability

Kaspersky Internet Security KIS, Kaspersky Security Software is a set of security software developed by Russia's Kaspersky Lab Kaspersky Lab with both antivirus and firewall functions. There are security vulnerabilities in KIS. A local attacker can exploit this vulnerability with a specially...

Domain penetration--Dump Clear-Text Password after KB2871997 installed-vulnerability warning-the black bar safety net

In penetration testing, the penetration tester will typically use mimikatz from the LSA of the memory to export system's plaintext password, while experienced administrators will often choose to install the patch kb2871997 to limit this behavior. This one relates to what are the interesting...

Cisco Web Security Appliance Connection Denial of Service Vulnerability

A vulnerability in Cisco AsyncOS for the Cisco Web Security Appliance WSA when the software handles a specific HTTP response code could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an appliance because the appliance runs out of system memory. The...

Cisco Web Security Appliance Cached Range Request Denial of Service Vulnerability

A vulnerability in the cached file-range request functionality of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an appliance due to the appliance running out of system memory. The vulnerability is d...