CVE-2015-6783

CVE-2015-6783 affects Google Chrome components on Android 5.x–6.x that use Crazy Linker. The vulnerability is in crazy_linker_zip.cpp FindStartOffsetOfFileInZipFile, where EOCD record search is faulty, allowing signature-validation bypass via a crafted ZIP archive. Public docs confirm this CVE wa...

Kaspersky AntiVirus - .ZIP File Format Use-After-Free

Kaspersky AntiVirus - .ZIP File Format Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=521 Fuzzing the ZIP file format found multiple memory corruption issues, some of which are obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM on an...

Debian DLA-337-1 : busybox security update

busybox, a collection of tiny utilities for small and embedded systems, was vulnerable to crashing when handling a specially crafted zip file. The issue was discovered by Gustavo Grieco. For Debian 6 Squeeze, this issue has been fixed in busybox version 1.17.1-8+deb6u11. NOTE: Tenable Network...

[SECURITY] [DLA 337-1] busybox security update

Package : busybox Version : 1:1.17.1-8+deb6u11 Debian Bug : 803097 busybox, a collection of tiny utilities for small and embedded systems, was vulnerable to crashing when handling a specially crafted zip file. The issue was discovered by Gustavo Grieco. For Debian 6 Squeeze, this issue has been...

DLA-337-1 busybox - security update

Bulletin has no description...

UBUNTU-CVE-2015-7804

Off-by-one error in the pharparsezipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service uninitialized pointer dereference and application crash by including the / filename in a .zip PHAR archive...

Security update for php5 (important)

The PHP5 script interpreter was updated to fix various security issues: CVE-2015-6831: A use after free vulnerability in unserialize has been fixed which could be used to crash php or potentially execute code. bnc942291 bnc942294 bnc942295 CVE-2015-6832: A dangling pointer in the unserialization ...

Android Dolphin Browser remote code execution-vulnerability warning-the black bar safety net

The attacker has the ability to by Android the Dolphin Browser to control the user's network communication data, you can modify the download and application browser new theme function. By using this function, an attacker can write arbitrary files, these files will be in the user device browser...

ManageEngine Service Desk File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine ServiceDesk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of uploaded files. The issue lies in the ability to use director...

ManageEngine Service Desk File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine ServiceDesk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of uploaded files. The issue lies in the ability to use director...

SysAid Help Desk 'rdslogs' Arbitrary File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'zlib' class Metasploit3 "SysAid Help Desk 'rdslogs' Arbitrary File Upload", 'Description' = %q This module exploits a file upload vulnerabilit...

File Roller v3.4.1 - Denial of Service (PoC)

File Roller v3.4.1 - Denial of Service PoC !/usr/bin/perl Title: File Roller - DoS PoC Date: 08/07/2015 Author: Arsyntex Homepage: https://wiki.gnome.org/Apps/FileRoller Version: v3.4.1 Tested on: Linux lab 3.2.0-85-generic-pae 122-Ubuntu i686 i386 GNU/Linux...

File Roller v3.4.1 - Denial of Service (PoC)

!/usr/bin/perl Title: File Roller - DoS PoC Date: 08/07/2015 Author: Arsyntex Homepage: https://wiki.gnome.org/Apps/FileRoller Version: v3.4.1 Tested on: Linux lab 3.2.0-85-generic-pae 122-Ubuntu i686 i386 GNU/Linux ------------------------------------------------------------------------- Create ...

Samsung mobile remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

Summary A remote attacker to completely have the ability to control user web traffic, the manipulation Samsung phone keyboard update mechanism, and on the target phone using the system user permission to execute code. On Samsung devices pre-installed quick keyboard cannot be disabled also cannot ...

JDownloader 2 Beta - Directory Traversal

JDownloader 2 Beta - Directory Traversal =begin Exploit Title: JDownloader 2 Beta Directory Traversal Vulnerability Zip Extraction Date: 2015-06-02 Exploit Author: PizzaHatHacker Vendor Homepage: http://jdownloader.org/home/index Software Link: http://jdownloader.org/download/offline Version: 117...

SysAid Help Desk 'rdslogs' Arbitrary File Upload

This module exploits a file upload vulnerability in SysAid Help Desk v14.3 and v14.4. The vulnerability exists in the RdsLogsEntry servlet which accepts unauthenticated file uploads and handles zip file contents in an insecure way. By combining both weaknesses, a remote attacker can accomplish...

Multiple AntiVirus Products ZIP File Scan Evasion Security Bypass - Ver2 (CVE-2012-1462)

A security bypass vulnerability has been reported in multiple products. An attacker could exploit this vulnerability via a ZIP file containing an invalid block of data at the beginning. Successful exploitation of this vulnerability would allow remote attackers to bypass malware protection and...

openSUSE Security Update : php5 (openSUSE-2015-282)

PHP was updated to fix several security issues. The following vulnerabilities were fixed : - A specially crafted GIF file could cause a buffer read overflow in php-gd CVE-2014-9709 bnc923946 - Memory was use after it was freed in PHAR CVE-2015-2301 bnc922022 - heap overflow vulnerability in...

Mandriva Linux Security Advisory : unzip (MDVSA-2015:123)

Updated unzip package fix security vulnerabilities : The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification CVE-2014-8139, the testcompreb CVE-2014-8140 and the getZip64Data CVE-2014-8141 functions. The input errors may result in in arbitrary code...

SUSE-SU-2015:0668-1 Security update for libzip

Libzip was updated to fix one security issue. A zip file with an unusually large number of entries could have caused an integer overflow leading to a write past the heap boundary, crashing the application. CVE-2015-2331 bnc923240...