Operation PowerFall: CVE-2020-0986 and variants

In August 2020, we published a blog post about Operation PowerFall. This targeted attack consisted of two zero-day exploits: a remote code execution exploit for Internet Explorer 11 and an elevation of privilege exploit targeting the latest builds of Windows 10. While we already described the...

CVE-2020-25016

A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to for example dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations...

CVE-2020-25016

A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to for example dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations...

CVE-2019-10878

In Teeworlds 0.7.2, there is a failed bounds check in CDataFileReader::GetData and CDataFileReader::ReplaceData and related functions in engine/shared/datafile.cpp that can lead to an arbitrary free and out-of-bounds pointer write, possibly resulting in remote code execution...

Microsoft Windows 2003 SP2 - RRAS SMB Remote Code Execution Exploit

Exploit for windows platform in category remote exploits !/usr/bin/env python -- coding: utf-8 -- Tested in Windows Server 2003 SP2 ES - Only works when RRAS service is enabled. The exploited vulnerability is an arbitraty pointer deference affecting the dwVarID field of the MIBOPAQUEQUERY...

Oracle OIT IX SDK libvs_pdf arbitrary pointer access(CVE-2016-3579)

Description When parsing a specially crafted PDF document, a value derived from a file is used as a memory pointer leading to a process crash. Tested Versions Outside In IX SDK 8.5.1. Product URLs http://www.oracle.com/technetwork/middleware/content-management/oit-all-085236.html Details When...

Race condition

In all Android releases from CAF using the Linux kernel, a race condition exists in a video driver potentially leading to buffer overflow or write to arbitrary pointer location...

CVE-2017-7372

CVE-2017-7372 affects Android devices using CAF Linux kernel video drivers. The issue is a race condition in a video driver that could lead to a buffer overflow or write to an arbitrary pointer location, as described in the NVD entry. No specific affected devices, versions, exploit details, or re...

MacOS kernel memory corruption due to off-by-one in audit_sdev_open (CVE-2017-2483)

The auditsession device has a copy-pasted version of the same bug as the auditpipe device: static int auditsdevopendevt dev, unused int flags, unused int devtype, proct p struct auditsdev asdev; struct auditinfoaddr aia; int u; u = minordev; if u MAXAUDITSDEVS return ENXIO; void auditsdevgetaiap,...

FreeBSD : vlc -- arbitrary pointer dereference vulnerability (a0a4e24c-4760-11e5-9391-3c970e169bc2)

oCERT reports : The stable VLC version suffers from an arbitrary pointer dereference vulnerability. The vulnerability affects the 3GP file format parser, insufficient restrictions on a writable buffer can be exploited to execute arbitrary code via the heap memory. A specific 3GP file can be craft...

vlc -- arbitrary pointer dereference vulnerability

oCERT reports: The stable VLC version suffers from an arbitrary pointer dereference vulnerability. The vulnerability affects the 3GP file format parser, insufficient restrictions on a writable buffer can be exploited to execute arbitrary code via the heap memory. A specific 3GP file can be crafte...

SIEMENS Sipass Integrated 2.6 Ethernet Bus Arbitrary Pointer Dereference

No description provided by source...

CVE-2014-1759

CVE-2014-1759 affects Microsoft Publisher 2003 SP3 and Publisher 2007 SP3 via the pubconv.dll component. The root cause is an (uninitialized/incorrect) pointer dereference when parsing crafted .pub files, enabling remote code execution or causing application crash (DoS). The vulnerability is trac...

MS14-020: Vulnerability in Microsoft Publisher Could Allow Remote Code Execution (2950145)

The Publisher component of Microsoft Office installed on the remote host is affected by an arbitrary pointer dereference vulnerability. A remote attacker could exploit this issue by tricking a user into opening a specially crafted Publisher file. The attacker could then potentially run arbitrary...

SIEMENS Sipass Integrated 2.6 Ethernet Bus - Arbitrary Pointer Dereference

IOActive Security Advisory Title: SIEMENS Sipass Integrated 2.6 Ethernet Bus Arbitrary Pointer Dereference Severity: Critical Discovered by: Lucas Apa Date Reported: 09/11/12 CVE: TBD Siemens Advisory: SSA-938777 Introduction SIEMENS SiPass® Integrated is an extremely powerful and flexible access...

iDefense Security Advisory 07.15.09: Microsoft Office Publisher 2007 Arbitrary Pointer Dereference Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 07.14.09 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 14, 2009 I. BACKGROUND Microsoft Office Publisher is a desktop publishing application. For more information, please visit following website:...

Novell NetIdentity Agent < 1.2.4 Arbitrary Pointer De-reference Code Execution

The 'xtagent.exe' program included with the version of Novell's NetIdentity Agent installed on the remote Windows host contains an arbitrary pointer de-reference vulnerability. Using specially crafted RPC messages over the 'XTIERRPCPIPE' named pipe, an attacker who can establish a valid IPC$...

Novell Client/NetIdentity Agent Remote Arbitrary Pointer Dereference Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Netware. A valid IPC$ connection must be established in order to exploit this vulnerability. The specific flaw exists within xtagent.exe during the handling of RPC messages over the...

CORE-2008-0122: MPlayer arbitrary pointer dereference

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs MPlayer arbitrary pointer dereference Advisory Information Title: MPlayer arbitrary pointer dereference Advisory ID: CORE-2008-0122 Advisory URL:...

MPlayer arbitrary pointer dereference

Advisory ID Internal CORE-2008-0122 Advisory Information Title: MPlayer arbitrary pointer dereference Advisory ID: CORE-2008-0122 Advisory URL:https://www.coresecurity.com/core-labs/advisories/mplayer-advisorie Date published: 2008-02-04 Date of last update: 2008-01-30 Vendors contacted: MPlayer...