MS13-106: Vulnerability in a Microsoft Office shared component could allow security feature bypass: December 10, 2013

This security update addresses the vulnerability by helping to make sure that the Microsoft Office shared component correctly implements address space layout randomization ASLR.INTRODUCTIONMicrosoft has released security bulletin MS13-106. To view the complete security bulletin, visit one of the...

Microsoft Office CVE-2013-5057 ASLR Security Bypass Vulnerability

Description Microsoft Windows is prone to a security-bypass vulnerability. An attacker can leverage this issue to bypass certain security restrictions and execute arbitrary code by exploiting another vulnerability in the application. Technologies Affected Microsoft Office 2007 SP3 Microsoft Offic...

GOM Player 2.2.53.5169 Buffer Overflow

!/usr/bin/perl Exploit Title: GOM Player 2.2.53.5169 - SEH Buffer Overflow .reg Date: 11-26-2013 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software/Version: GOM Player 2.2.53.5169 Vendor Site: http://player.gomlab.com/eng/ Vulnerable Software Link:...

MS13-106: Farewell to another ASLR bypass

Today we released MS13-106 which resolves a security feature bypass that can allow attackers to circumvent Address Space Layout Randomization ASLR using a specific DLL library HXDS.DLL provided as part of Microsoft Office 2007 and 2010. The existence of an ASLR bypass does not directly enable the...

Microsoft Enhanced Mitigation Experience Toolkit (EMET) ROP Vulnerability

The host is installed with Microsoft Enhanced Mitigation Experience Toolkit EMET and is prone to return-oriented programming ROP vulnerability. OpenVAS Vulnerability Test $Id: gbmicrosoftemetropvuln.nasl 6104 2017-05-11 09:03:48Z teissa $ Microsoft Enhanced Mitigation Experience Toolkit EMET ROP...

Microsoft Enhanced Mitigation Experience Toolkit (EMET) ROP Vulnerability

Microsoft Enhanced Mitigation Experience Toolkit EMET is prone to return-oriented programming ROP vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Microsoft EMET 3.x >= 3.5 / 4.x < 4.0.4913.26122 ASLR Security Bypass

Microsoft's Enhanced Mitigation Experience Toolkit EMET is installed on the remote system and is 3.x newer than or equal to 3.5 or 4.x prior to 4.0.4913.26122. It is, therefore, potentially affected by a security bypass vulnerability. The application stores function addresses in a predictable way...

Design/Logic Flaw

Microsoft Enhanced Mitigation Experience Toolkit EMET before 4.0 uses predictable addresses for hooked functions, which makes it easier for context-dependent attackers to defeat the ASLR protection mechanism via a return-oriented programming ROP attack...

CVE-2013-6791

EMET (Microsoft Enhanced Mitigation Experience Toolkit) is affected by a ROP/ASLR bypass vulnerability (CVE-2013-6791) where EMET versions before 4.0 store hooked function addresses in a predictable way. This weakness could enable context-dependent attackers to defeat ASLR, as described in source...

CVE-2013-6791

Microsoft Enhanced Mitigation Experience Toolkit EMET before 4.0 uses predictable addresses for hooked functions, which makes it easier for context-dependent attackers to defeat the ASLR protection mechanism via a return-oriented programming ROP attack...

Adobe Acrobat Reader - ASLR + DEP Bypass with Sandbox Bypass

Adobe Acrobat Reader - ASLR + DEP Bypass with Sandbox Bypass CVE-2013-0640/1 Somehow, our script got on to the Russian forums :/ @w3bd3vil and @abh1sek Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/29881.tar.gz Adobe Acrobat Reader ASLR/DEP...

Adobe Acrobat Reader - ASLR + DEP Bypass with Sandbox Bypass

CVE-2013-0640/1 Somehow, our script got on to the Russian forums :/ @w3bd3vil and @abh1sek Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29881.tar.gz Adobe Acrobat Reader ASLR/DEP bypass Exploit with SANDBOX BYPASS...

MS12-022 Microsoft Internet Explorer COALineDashStyleArray Unsafe Memory Access

Exploit for windows platform in category remote exploits This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 EOS def initializeinfo= superupdateinfoinfo, 'Name' = "MS12-022 Microsoft...

Microsoft Internet Explorer COALineDashStyleArray Unsafe Memory Access

This Metasploit module exploits a vulnerability on Microsoft Silverlight. The vulnerability exists on the Initialize method from System.Windows.Browser.ScriptObject, which access memory in an unsafe manner. Since it is accessible for untrusted code user controlled it's possible to dereference...

ALLPlayer 5.7 Buffer Overflow

!/usr/bin/perl Exploit Title: ALLPlayer 5.7 .m3u - SEH Buffer Overflow Unicode Date: 11-23-2013 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software: ALLPlayer 5.7 Software Link: http://www.allplayer.org/download/allplayer Version: 5.7 Tested On: Windows XP SP3 and Windows 7 P...

Immunity Canvas: IE_CARDSPACECLAIMCOLLECTION

Name| iecardspaceclaimcollection ---|--- CVE| CVE-2013-3918 Exploit Pack| CANVAS Description| iecardspaceclaimcollection Notes| CVE Name: CVE-2013-3918 VENDOR: Microsoft NOTES: - This exploits leaks a vtable pointer of a CTable object in order to bypass ASLR - We also leak the shellcode's address...

libjpeg/libjpeg-turbo Library CVE-2013-6629 Memory Corruption Vulnerability

Description libjpeg and libjpeg-turbo libraries are prone to a memory-corruption vulnerability. Attackers can exploit this issue to bypass Address Space Layout Randomization ASLR protection mechanisms of applications. This may aid in further attacks that may lead to arbitrary code execution...

CVE-2013-3906 : Zero Day Vulnerability in Microsoft Graphics Component

Microsoft has issued a temporary fix for a 0day vulnerability that can be exploited to install malware via infected Word documents. A Zero-day Remote code execution flaw, which has been dubbed CVE-2013-3906, exploits a vulnerability in a Microsoft graphics component, to target Microsoft Office...

BlazeDVD 6.2 (.plf) - Buffer Overflow (SEH) Exploit

Exploit for windows platform in category local exploits !/usr/bin/perl Exploit Title: BlazeDVD 6.2 .plf Buffer Overflow SEH Date: 10-28-2013 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software: BlazeDVD 6.2 Software Link:...

Photodex ProShow Producer 5.0.3310 - Local Buffer Overflow (SEH)

Exploit for windows platform in category local exploits !/usr/bin/perl Exploit Title: Photodex ProShow Producer v5.0.3310 - Local Buffer Overflow SEH Date: 10-26-2013 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software: Photodex ProShow Producer v5.0.3310 Software Link:...