Design/Logic Flaw

Huawei smart phone Taurus-AL00B with versions earlier than 10.0.0.203C00E201R7P2 have a use-after-free UAF vulnerability. An authenticated, local attacker may perform specific operations to exploit this vulnerability. Successful exploitation may tamper with the information to affect the...

CVE-2020-9065

Huawei smart phone Taurus-AL00B with versions earlier than 10.0.0.203C00E201R7P2 have a use-after-free UAF vulnerability. An authenticated, local attacker may perform specific operations to exploit this vulnerability. Successful exploitation may tamper with the information to affect the...

CVE-2020-9065

Huawei Taurus-AL00B smartphones running versions before 10.0.0.203 (C00E201R7P2) contain a use‑after‑free (UAF) vulnerability. An authenticated, local attacker can perform specific operations to tamper with information and impact availability. CVE-2020-9065 has a NVD CVSSv3.1 base score of 5.5 (L...

PHP 7.0 < 7.4 (Unix) - debug_backtrace disable_functions Bypass Exploit

a; $backtrace = new Exception-getTrace; ; if!isset$backtrace1'args' PHP = 7.4 $backtrace = debugbacktrace; class Helper public $a, $b, $c, $d; function str2ptr&$str, $p = 0, $s = 8 $address = 0; for$j = $s-1; $j = 0; $j-- $address = 8; return $out; function write&$str, $p, $v, $n = 8 $i = 0; for$...

Windows kernel NtUserScrollDC memory corruption

The attached testcases crashes Windows 7 x86 with Special Pool enabled on win32k. The crash occurs while accessing unmapped memory. The bogus address is returned by a call to FastWindowFromDC. This is likely to be a freed window object. Recent assessments: busterb at May 09, 2019 5:57pm UTC...

Samsung SEND_FILE_WITH_HEADER Use-After-Free

Samsung: UAF via missing locking in SENDFILEWITHHEADER handler in fmtpsamsung.c Tested on a Samsung A50 SM-A505FN, running build "samsung/a50xx/a50:9/PPR1.180610.011/A505FNXXS3ASK9:user/release-keys", security patch level 2019-11-01. Samsung's kernel tree contains two implementations of...

Samsung SEND_FILE_WITH_HEADER Use-After-Free Exploit

Samsung suffers from a use-after-free vulnerability due to a missing lock in the SENDFILEWITHHEADER handler in fmtpsamsung.c. Samsung: UAF via missing locking in SENDFILEWITHHEADER handler in fmtpsamsung.c Tested on a Samsung A50 SM-A505FN, running build...

PHP 7.0 < 7.4 (Unix) - 'debug_backtrace' disable_functions Bypass

a; $backtrace = new Exception-getTrace; ; if!isset$backtrace1'args' PHP = 7.4 $backtrace = debugbacktrace; class Helper public $a, $b, $c, $d; function str2ptr&$str, $p = 0, $s = 8 $address = 0; for$j = $s-1; $j = 0; $j-- $address = 8; return $out; function write&$str, $p, $v, $n = 8 $i = 0; for$...

CVE-2019-10494

Race condition between the camera functions due to lack of resource lock which will lead to memory corruption and UAF issue in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

Race condition

Race condition between the camera functions due to lack of resource lock which will lead to memory corruption and UAF issue in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

CVE-2019-10494

Race condition between the camera functions due to lack of resource lock which will lead to memory corruption and UAF issue in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

CVE-2019-10494

CVE-2019-10494 is a race condition in the camera function stack due to missing resource locks, leading to memory corruption and a use-after-free in Qualcomm/Snapdragon device families (APQ8009, APQ8017, APQ8053, … SM8150). The issue affects Snapdragon Auto, Snapdragon Mobile, and related SoCs; Re...

CVE-2019-10494: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition between the camera functions due to lack of resource lock which will lead to memory corruption and UAF issue in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

CVE-2019-8912

In the Linux kernel afalgrelease in crypto/afalg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free UAF in sockfssetattr. A local attacker can use this flaw to escalate privileges and take control of the system...

From BinDiff to 0day: Internet Explorer UAF vulnerability analysis-vulnerability warning-the black bar safety net

The last 6 months, I to Microsoft the report the IE browser in aUAF（after the release of the reused vulnerability vulnerability is the official positioning of the severity levels, numberedCVE-2019-1208, Microsoft in 9 monthsPatch Tuesdayfixes this vulnerability. I byBinDiff a binary code analysis...

Fedora 29 : php (2019-f07db8f031)

PHP version 7.2.21 01 Aug 2019 Date: - Fixed bug php69044 discrepency between time and microtime. krakjoe EXIF: - Fixed bug php78256 heap-buffer-overflow on exifprocessusercomment. CVE-2019-11042 Stas - Fixed bug php78222 heap-buffer-overflow on exifscanthumbnail. CVE-2019-11041 Stas Fileinfo: -...

Privilege Escalation in PAN-OS

Palo Alto Networks is aware of a use-after-free UAF vulnerability in the Linux kernel's sockfssetattr. Ref: PAN-113631/ CVE-2019-8912 Successful exploitation of this issue may allow an unprivileged local user to escalate their privileges on the system. This issue affects PAN-OS 7.1.23 and earlier...

Each rush of the weekend, all need to work together light getting tired of the twice cooked pork to enrich their inexplicable restlessness-vulnerability warning-the black bar safety net

Each rush of the weekend, all need to work together light getting tired of the twice cooked pork, to enrich yourself of the inexplicable restlessness that! Today, we'll take you to re-咂摸 a classic DOM UAF vulnerabilities is! To Re-analysis of a classic DOM UAF vulnerability case study: Firefox...

RHEL 6 : kernel-rt (RHSA-2019:1487)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1487 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

Input validation

In binderthreadread of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndro...