Return to libstagefright: exploiting libutils on Android

Posted by Mark Brand, Invalidator of Unic�o�d�e I’ve been investigating different fuzzing approaches on some Android devices recently, and this turned up the following rather interesting bug CVE 2016-3861 fixed in the most recent Android Security Bulletin, deep in the bowels of the usermode Andro...

Eye of Gnome 3.10.2 - GMarkup Out of Bounds Write

Exploit Title: Gnome Eye of Gnome Out-of-bounds-write Exploit Author: Kaslov Dmitri Vendor Homepage: https://wiki.gnome.org/Apps/EyeOfGnome Version: 3.10.2 Tested on: Ubuntu 14.04 LTS CVE: CVE-2016-6855 Proof of Concept:...

F5 Networks BIG-IP : glibc vulnerability (SOL09408132)

Integer overflow in posix/fnmatch.c in the GNU C Library aka glibc or libc6 2.13 and earlier allows context-dependent attackers to cause a denial of service application crash via a long UTF8 string that is used in an fnmatch call with a crafted pattern argument, a different vulnerability than...

PT-2016-6813

Name of the Vulnerable Software and Affected Versions libidn versions prior to 1.33 Description The issue allows context-dependent attackers to cause a denial of service, resulting in an out-of-bounds read and crash, via crafted UTF-8 data. This is due to a problem in the stringprep utf8 nfkc...

PT-2016-5883 · Cjson +2 · Cjson +2

Name of the Vulnerable Software and Affected Versions: cJSON library affected versions not specified Description: The issue is related to the mishandling of UTF8/16 strings by the parse string function in the cJSON library. This allows remote attackers to cause a denial of service crash or execut...

The vulnerability of the PHP interpreter, which allows attackers to trigger a service failure or exert other effects.

The vulnerability of the xmlutf8encode function ext/xml/xml.c in the PHP interpreter is related to buffer overflows in dynamic memory, caused by integer overflows. Exploiting this vulnerability could allow an attacker to cause a service failure or potentially have other effects through a long...

PT-2016-2090

Name of the Vulnerable Software and Affected Versions PHP versions prior to 7.0.4 Description The issue is related to an integer overflow in the xml utf8 encode function, which can cause a heap-based buffer overflow. This can be triggered by a remote attacker using a long argument to the utf8...

dom.hastin.gs XSS vulnerability

Vulnerable URL: http://dom.hastin.gs/files/utf8/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check dom.hastin.gs SSL connection:...

PT-2016-6031

Name of the Vulnerable Software and Affected Versions Libksba versions prior to 1.3.4 Description The issue is caused by an off-by-one error in the append utf8 value function within the DN decoder dn.c in Libksba. This error allows remote attackers to cause a denial of service out-of-bounds read...

file security, bug fix, and enhancement update

5.04-30 - fix CVE-2014-3538 unrestricted regular expression matching 5.04-29 - fix 1284826 - try to read ELF header to detect corrupted one 5.04-28 - fix 1263987 - fix bugs found by coverity in the patch 5.04-27 - fix CVE-2014-3587 incomplete fix for CVE-2012-1571 - fix CVE-2014-3710 out-of-bound...

74CMS (V 3.5.2 - 20150423) utf8_to_gbk() 不安全性造成的SQL注入

No description provided by source...

PT-2015-5574

Name of the Vulnerable Software and Affected Versions libin versions prior to 1.31 jabberd2 affected versions not specified Description The issue allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which...

UBUNTU-CVE-2015-5380

The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a deni...

Critical DoS Bug in Node.js, io.js Patched

Developers at Node.js over the weekend released a critical update to the open source runtime environment that addresses a bug that could be used to cause denial of service attacks. The JavaScript framework is used in one way or another by a handful of companies, including Netflix, PayPal, the New...

CakePHP 2.6.6 and 3.0.6 Released

CakePHP 2.6.6 and 3.0.6 Released The CakePHP core team is ready to announce the immediate availability of CakePHP 2.6.6 and 3.0.6. These are maintenance releases that contain important security fixes. Security Fixes Earlier this week we were notified that RequestHandlerComponent had a vulnerabili...

Wordpress is continuously explosion two stored XSS, the impact of the latest version-bug warning-the black bar safety net

! /Article/UploadPic/2015-4/201542811437550.jpg The official Wordpress in 4 on 2 1, released new version 4. 1. 2, wherein the mentioned fixes a serious memory typexssvulnerabilities. Soon someone shows vulnerability details. Thisxssstill appear in the wordpress comments, but the problem is caused...

Wordpress < 4.1.2 storage type XSS analysis and stability of the POC-vulnerability warning-the black bar safety net

Wordpress thisXSSis actually very easy to use, anonymous users can post and trigger, this gives a simple analysis of the stability of the trigger of the POC. In fact, the vulnerability of the author in the articlexss-vulnerability-4-1-2/"...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the mutt-utf8 package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

PT-2015-4239

Name of the Vulnerable Software and Affected Versions GNU less versions prior to 475 Description The issue is related to the is utf8 well formed function, which can be triggered by malformed UTF-8 characters. This leads to an out-of-bounds read, allowing remote attackers to have an unspecified...

F5 Networks BIG-IP : GNU C Library vulnerability (SOL15885)

The GNU C Library aka glibc or libc6 before 2.12.2 and Embedded GLIBC EGLIBC allow context-dependent attackers to execute arbitrary code or cause a denial of service memory consumption via a long UTF8 string that is used in an fnmatch call, aka a 'stack extension attack,' a related issue to...