PT-2017-19193

Name of the Vulnerable Software and Affected Versions Apache Storm versions 1.0.0 through 1.0.3 Apache Storm versions 1.1.0 through 1.1.0 Description A security issue was discovered in Apache Storm where, under certain situations and configurations, the owner of a topology could potentially trick...

CVE-2017-9799: Undefined Security Weakness

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure...

Varnish HTTP Cache Denial of Service Vulnerability

Varnish HTTP Cache is a reverse proxy server and cache server developed by Danish software developer Poul-Henning Kamp. The server uses Visual Page Cache technology, which enables all cached data to be read directly from memory, thus increasing access speeds. A security vulnerability exists in...

CVE-2017-12425

An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the...

CVE-2017-12425: Integer Overflow or Wraparound

An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the...

Apple Safari 10.1 - Spread Operator Integer Overflow Remote Code Execution Exploit

Exploit for macOS platform in category remote exploits Sources: https://phoenhex.re/2017-06-02/arrayspread https://github.com/phoenhex/files/blob/master/exploits/spread-overflow JavaScriptCore will allocate a JSFixedArray for every spread operand of the array literal in slowpathspread. As such,...

Apple Safari 10.1 - Spread Operator Integer Overflow Remote Code Execution

Apple Safari 10.1 - Spread Operator Integer Overflow Remote Code Execution Sources: https://phoenhex.re/2017-06-02/arrayspread https://github.com/phoenhex/files/blob/master/exploits/spread-overflow JavaScriptCore will allocate a JSFixedArray for every spread operand of the array literal in...

Apple Safari 10.1 - Spread Operator Integer Overflow Remote Code Execution

Sources: https://phoenhex.re/2017-06-02/arrayspread https://github.com/phoenhex/files/blob/master/exploits/spread-overflow JavaScriptCore will allocate a JSFixedArray for every spread operand of the array literal in slowpathspread. As such, roughly 4 billion JSValues will have to be allocated,...

Heroku Dynos Explained

What are Heroku Dynos? If youve ever hosted an application on Heroku, the popular platform as a service, youre likely at least aware of the existence of "Dynos". But what exactly are Heroku Dynos and why are they important? As explained in Herokus docs, Dynos are simply lightweight Linux containe...

Fedora 24 : 1:dovecot (2017-da4ed58fd5)

quota: Add plugin quotamaxmailsize setting to limit the maximum individual mail size that can be saved. + imapc: Add imapcfeatures=delay-login. If set, connecting to the remote IMAP server isn't done until it's necessary. + imapc: Add imapcconnectionretrycount and imapcconnectionretryinterval...

Aerospike Database Server Multiple Null Pointer References Denial of Service Vulnerability

Aerospike Database Server is a distributed, scalable NoSQL database from Aerospike, Inc. A security vulnerability in the fabric-worker component of Aerospike Database Server allows remote attackers to exploit the vulnerability by submitting special data messages to crash the application...

CVE-2016-9049

An exploitable denial-of-service vulnerability exists in the fabric-worker component of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server process to dereference a null pointer. An attacker can simply connect to a TCP port in order to trigger this vulnerability...

Null pointer dereference

An exploitable denial-of-service vulnerability exists in the fabric-worker component of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server process to dereference a null pointer. An attacker can simply connect to a TCP port in order to trigger this vulnerability...

CVE-2016-9049

An exploitable denial-of-service vulnerability exists in the fabric-worker component of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server process to dereference a null pointer. An attacker can simply connect to a TCP port in order to trigger this vulnerability...

CVE-2016-9049

CVE-2016-9049 : A denial-of-service in Aerospike Database Server’s fabric-worker (3.10.0.3) can be triggered by a crafted packet over TCP. The exploit writes to a NULL pointer due to a vulnerable allocation path when handling large message sizes, leading to a crash. A PoC exists and targets port ...

CVE-2016-9049: NULL Pointer Dereference

An exploitable denial-of-service vulnerability exists in the fabric-worker component of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server process to dereference a null pointer. An attacker can simply connect to a TCP port in order to trigger this vulnerability...

Aerospike Database Server Fabric-Worker Socket-Loop Denial-of-Service Vulnerability

Summary An exploitable denial-of-service vulnerability exists in the fabric-worker component of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server process to dereference a null pointer. An attacker can simply connect to a TCP port in order to trigger this...

Trend Micro Virtual Mobile Infrastructure Arbitrary Command Execution Vulnerability

Trend Micro Virtual Mobile Infrastructure is a solution that enables IT managers to host enterprise applications and data in a secure mobile operating system on a central server. A security vulnerability in the handlecertificate function in Trend Micro Virtual Mobile Infrastructure...

The vulnerability of the Flash Player software, which allows a violator to execute arbitrary code

The vulnerability of the Worker class in the Flash Player software platform arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Flash Player software, which allows a violator to execute arbitrary code

The vulnerability of the Worker class in the Flash Player software platform arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure due to memory corruption...