Buffer overflow

Cisco Sourcefire Snort 3.0 before build 233 has a Buffer Overread related to use of a decoder array. The size was off by one making it possible to read past the end of the array with an ether type of 0xFFFF. Increasing the array size solves this problem...

CVE-2017-6657

Cisco Sourcefire Snort 3.0 before build 233 mishandles Ether Type Validation. Since valid ether type and IP protocol numbers do not overlap, Snort++ stores all protocol decoders in a single array. That makes it possible to craft packets that have IP protocol numbers in the ether type field which...

CVE-2017-6658

Cisco Sourcefire Snort 3.0 before build 233 has a Buffer Overread related to use of a decoder array. The size was off by one making it possible to read past the end of the array with an ether type of 0xFFFF. Increasing the array size solves this problem...

(Pwn2Own) Apple Safari Array concat Integer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the...

(Pwn2Own) Microsoft Chakra Array unshift Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Chakra. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

(Pwn2Own) Microsoft Chakra Array Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Chakra. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

CVE-2017-0347

All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array, which may lead to denial of service or potenti...

CVE-2017-8831

The saa7164busget function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service out-of-bounds array access or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch"...

Apple Safari - Array concat Memory Corruption

Apple Safari - Array concat Memory Corruption !-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1095 There is an out-of-bounds memcpy in Array.concat that can lead to memory corruption. In builtins/ArrayPrototype.js, the function concatSlowPath calls a native method...

Safari Browser: Memory corruption in Array concat (CVE-2017-2464)

There is an out-of-bounds memcpy in Array.concat that can lead to memory corruption. In builtins/ArrayPrototype.js, the function concatSlowPath calls a native method @appendMemcpy with a parameter resultIndex that is handled unsafely by the method. It calls JSArray::appendMemcpy, which calculates...

CVE-2017-7979

The cookie feature in the packet action API implementation in net/sched/actapi.c in the Linux kernel 4.11.x through 4.11-rc7 mishandles the tb nlattr array, which allows local users to cause a denial of service uninitialized memory access and refcount underflow, and system hang or crash or possib...

Phpcms V9. 6. 0 any file write getshell vulnerability analysis-vulnerability warning-the black bar safety net

1 Introduction: It is said to be one in the underground has been around for half a 0day, which has recently been broke to, in the membership registration page, that this vulnerability without the need to login you can use, or more powerful. 2 vulnerability analysis: Follow up on the registration...

Aerospike Database Server RW Fabric Message Code Execution (CVE-2016-9053)

An out-of-bounds array indexing vulnerability has been reported in Aerospike Database Server. The vulnerability is due to improper handling of a fabric message containing a request to write a record element with malicious type value. A remote attacker could exploit this vulnerability by sending a...

Microsoft Internet Explorer Scripting Engine Memory Corruption (CVE-2017-0158)

A Use-After-Free vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to an error in the way VBScript engine manipulates the assignment of dynamic-array variables. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted web page...

Adobe Reader DC XFA Array Index Integer Underflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within XFA's...

Microsoft Windows ADO Array-Type Parameter Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Huawei OceanStor 5800 Integer Overflow Vulnerability

Huawei OceanStor 5800 is a storage system for mid-range and high-end storage from Huawei China. An integer overflow vulnerability exists in Huawei OceanStor 5800 V300R003C00 version. An attacker can exploit this vulnerability by sending a large number of abnormal NFS Network File System messages ...

Exploit for Classic Buffer Overflow in Microsoft

IIS6.0WebDAVRuby Ruby Exploit for IIS 6.0 Buffer...

shopify-scripts: SIGSEGV in array_copy - array.c:71

File 2 as input causes a segfault in mruby. mruby crashes in arycopy array.c:71: Program received signal SIGSEGV, Segmentation fault. 0x000000000040e088 in arraycopy src=, size=, dst= at /tmp/mruby/src/array.c:71 71 dsti = srci; Test platform: Linux 3.16.0-4-amd64 1 SMP Debian 3.16.39-1+deb8u1...

CVE-2016-6177

The Huawei OceanStor 5800 V300R003C00 has an integer overflow vulnerability. An authenticated attacker may send massive abnormal Network File System NFS packets, causing an anomaly in specific disk arrays...