PT-2017-2404

Name of the Vulnerable Software and Affected Versions Xen affected versions not specified Description The issue allows local x86 guest OS users to modify arbitrary memory, obtain sensitive information, cause a denial of service host crash, or execute arbitrary code on the host. This is due to...

LibTIFF tools/tiffcrop.c integer overflow vulnerability

Silicon Graphics LibTIFF is a library for reading and writing TIFF Tagged Image File Format files from Silicon Graphics, USA. The library contains a number of command-line tools for processing TIFF files. A security vulnerability exists in libtiff version 4.0.6 in tools/tiffcrop.c, which can be...

Linux Kernel 4.6.3 Netfilter Privilege Escalation

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "msf/core" class MetasploitModule 'Linux Kernel 4.6.3 Netfilter Privilege Escalation', 'Description' = %q This module attempts to exploit a netfilter bug on Linux...

Linux/x86-64 - /bin/sh -c reboot Shellcode (89 bytes)

Name: "Linux reboot bin/sh -c reboot shellcode" 89 bytes Platform: Linux 32 and 64 bit Author: Ashiyane Digital Security Team MALWaRE43 Contact: usertester123546 at gmail.com Tested on: Linux javadkhof 4.4.0-47-generic 68-Ubuntu SMP Wed Oct 26 19:39:52 UTC 2016 x8664 x8664 x8664 GNU/Linux Linux...

CVE-2016-9383

Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service host crash, or execute arbitrary code on the host by leveraging broken emulation of bit test instructions...

guest 32-bit ELF symbol table load leaking host data

ISSUE DESCRIPTION Along with their main kernel binary, unprivileged guests may arrange to have their Xen environment load kernel symbol tables for their use. The ELF image metadata created for this purpose has a few unused bytes when the symbol table binary is in 32-bit ELF format. These unused...

x86 task switch to VM86 mode mis-handled

ISSUE DESCRIPTION LDTR, just like TR, is purely a protected mode facility. Hence even when switching to a VM86 mode task, LDTR loading needs to follow protected mode semantics. This was violated by the code. IMPACT On SVM AMD hardware: a malicious unprivileged guest process can escalate its...

xen-kernel -- x86 null segments not always treated as unusable

The Xen Project reports: The Xen x86 emulator erroneously failed to consider the unusability of segments when performing memory accesses. The intended behaviour is as follows: The user data segment %ds, %es, %fs and %gs selectors may be NULL in 32-bit to prevent access. In 64-bit, NULL has a...

xen-kernel -- x86 64-bit bit test instruction emulation broken

The Xen Project reports: The x86 instructions BT, BTC, BTR, and BTS, when used with a destination memory operand and a source register rather than an immediate operand, access a memory location offset from that specified by the memory operand as specified by the high bits of the register source. ...

Microsoft Edge - 'CText­Extractor::Get­Block­Text' Out-of-Bounds Read (MS16-104)

::first-letter border: 0; white-space: pre-line; Aalert;&x­D;&x­D;B Description Though I did not investigate thoroughly, I did find out the following: The root cause appears to be an integer underflow in a 32-bit variable used in CText­Extractor..Get­Block­Text as an index to read a WCHAR in a...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2016-11414)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A denial-of-service vulnerability exists in versions of Mozilla Firefox prior to 50 on 64-bit Windows-based platforms, which stems from a failure of the 64-bit NPAPI plug-in to enable sandboxin...

Fedora 25 : ca-certificates (2016-d1408c3ba3)

This is an update to the Mozilla CA certificates list version 2.9, which has been published as part of Mozilla NSS 3.26. This update reverts the CA list to the unmodified upstream CA list. The legacy CA modifications, which had previously been shipped with Fedora, have been reverted to an empty...

PT-2016-3445

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 50 Description The issue is related to the sandbox for 64-bit NPAPI plugins not being enabled by default when a new Firefox profile is created on 64-bit Windows installations. This can allow a remote attacker to bypas...

Fedora 25 : xen (2016-1d8429b89f)

fix build problem with glibc 2.24 x86: Disallow L3 recursive pagetable for 32-bit PV guests XSA-185, CVE-2016-7092 x86: Mishandling of instruction pointer truncation during emulation XSA-186, CVE-2016-7093 x86 HVM: Overflow of shctxt-segreg XSA-187, CVE-2016-7094 pandoc documentation has dependen...

Ansible Security Bypass Vulnerability (CNVD-2016-10736)

Ansible is a newly emerged operation and maintenance tool that is based on Python and combines the advantages of many old operation and maintenance tools to achieve batch operating system configuration, batch program deployment, batch running commands and other functions. A security bypass...

Microsoft Windows Kernel 'Win32k.sys' CVE-2016-7215 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit...

Microsoft Windows CVE-2016-7225 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to run processes with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Syste...

Microsoft SQL Server CVE-2016-7254 Privilege Escalation Vulnerability

Description Microsoft SQL Server is prone to a privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Technologies Affected Microsoft SQL Server 2012 for 32-bit Systems Service Pack 2 Microsoft SQL Server 2012 for 32-bit Systems Service Pack 3 Microsof...

Microsoft Windows CVE-2016-7224 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to run processes with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Syste...

Microsoft Windows CVE-2016-7223 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to run processes with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Syste...