CVE-2017-9671

A heap overflow in apk Alpine Linux's package manager allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a malicious APKINDEX.tar.gz file with a bad pax header block...

ALPINE-CVE-2017-9671

A heap overflow in apk Alpine Linux's package manager allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a malicious APKINDEX.tar.gz file with a bad pax header block...

CVE-2017-9671

A heap overflow in apk Alpine Linux's package manager allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a malicious APKINDEX.tar.gz file with a bad pax header block...

CVE-2017-9671

CVE-2017-9671 , reported for Alpine Linux apk, describes a heap overflow in the tar parsing path (archive.c/apk_parse_tar) triggered by a signed int parameter in blob_realloc. The code reallocates a buffer based on newsize (int) while the buffer length is long, allowing large sizes to wrap to neg...

CVE-2017-9669

Affects Alpine Linux’s package manager (apk). CVE-2017-9669 stems from a heap overflow in the tar parsing code (archive.c) triggered by a signed int blob_realloc used to grow the longname buffer. If a large size overflows, is->read may copy more bytes than allocated, causing a heap overflow. M...

CVE-2017-9669

A heap overflow in apk Alpine Linux's package manager allows a remote attacker to cause a denial of service, or achieve code execution by crafting a malicious APKINDEX.tar.gz file...

CVE-2017-9671

A heap overflow in apk Alpine Linux's package manager allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a malicious APKINDEX.tar.gz file with a bad pax header block...

Alpine Linux's package manager buffer overflow vulnerability

Alpine Linux's package manager apk is a package management tool for Linux. The tool is used to install, upgrade or remove software on a running system. A heap buffer overflow vulnerability exists in Alpine Linux's package manager. A remote attacker can exploit this vulnerability by creating a...

Alpine Linux: from vulnerability discovery to code execution a-vulnerability warning-the black bar safety net

One, Foreword Recently I was in the Alpine Linux package Manager found two serious vulnerabilities, exploits, numbered CVE-2017-9669 and CVE-2017-9671。 If you are using Alpine, an attacker may use these two holes in your host to execute malicious code. Alpine Linux is a lightweight Linux...

Code injection

The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary...

CVE-2017-3214

The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary...

CVE-2017-3214

The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary...

CVE-2017-3214

The CVE-2017-3214 entry concerns the Milwaukee ONE-KEY Android app, where the master token is stored in plaintext inside the APK binary. Connected sources corroborate this as part of a broader set of findings in IoT security testing: the master credentials are needed to obtain a bearer token, whi...

Super Android Analyzer

Super Android Analyzer Secure, Unified, Powerful and Extensible Rust Android Analyzer SUPER is a command-line application that can be used in Windows, MacOS X and Linux, that analyzes .apk files in search for vulnerabilities. It does this by decompressing APKs and applying a series of rules to...

Infect Android Application With Meterpreter Payload: kwetza

Infect Android Application With Meterpreter Payload Kwetza infects an existing Android application with either custom or default payload templates to avoid detection by antivirus. Kwetza allows you to infect Android applications using the target application’s default permissions or inject...

Mobile Security Framework: MobSF

Mobile Security Framework is an intelligent, all-in-one open source mobile application Android/iOS automated pen-testing framework capable of performing static and dynamic analysis. We’ve been depending on multiple tools to carry out reversing, decoding, debugging, code review, and pen-test and...

CVE-2017-0522

An elevation of privilege vulnerability in a MediaTek APK could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High due to the possibility of local arbitrary code execution in a privileged process. Product: Android...

CVE-2017-0522

CVE-2017-0522 describes an elevation of privilege in a MediaTek APK on Android that could allow a local malicious app to execute code in a privileged process. The issue is characterized as High impact with local execution of arbitrary code within a privileged context. The affected component is th...

Android Package Inspector: Inspeckage

Inspeckage is a tool developed to offer dynamic analysis of Android applications. By applying hooks to functions of the Android API, Inspeckage will help you understand what an Android application is doing at runtime. Inspeckage will let you interact with some elements of the app, such as...

Chrome: bypass for download filetype blacklist, extension->native privesc

This bug report describes a vulnerability that can be used by an extension with some permissions to escalate to native code execution on Linux desktops if Java is installed. No user interaction is required. Chrome permits extensions with appropriate permissions "downloads" and "downloads. open" t...