Microsoft Edge Chakra JIT - Bound Check Elimination Bug Exploit

Exploit for windows platform in category dos / poc / Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instaed of the control flow. This may lead to incorrectly remove the bound checks. In th...

Microsoft Edge Chakra JIT - Bound Check Elimination Bug

/ Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instaed of the control flow. This may lead to incorrectly remove the bound checks. In the following code, currentBlock's block number is 4...

CVE-2018-9969

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.21.1 - media: imon: Fix null-ptr-deref in imonprobe Arvind Yadav Orabug: 27208380 CVE-2017-16537 - Input: gtco - fix potential out-of-bound access Dmitry Torokhov Orabug: 27215090 CVE-2017-16643 - usb: usbtest: fix NULL pointer dereference Alan Stern Orabug: 27602324...

Denial Of Service (DoS) Through Out-of-bound Reads

libtiff.so is susceptible to denial of service DoS via out-of-bound reads. The vulnerability is due to the application not properly checking the buffer size when reading TIFF images...

Amazon Linux 2 : corosync (ALAS-2018-1014)

Integer overflow in exec/totemcrypto.c:authenticatenss23 function An integer overflow leading to an out-of-bound read was found in authenticatenss23 in Corosync. An attacker could craft a malicious packet that would lead to a denial of service.CVE-2018-1084 C Tenable Network Security, Inc. The...

Important: corosync

Issue Overview: Integer overflow in exec/totemcrypto.c:authenticatenss23 function An integer overflow leading to an out-of-bound read was found in authenticatenss23 in Corosync. An attacker could craft a malicious packet that would lead to a denial of service.CVE-2018-1084 Affected Packages:...

Medium: httpd24

Issue Overview: Use-after-free on HTTP/2 stream shutdown When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this...

EulerOS 2.0 SP2 : dhcp (EulerOS-SA-2018-1073)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use...

EulerOS 2.0 SP1 : dhcp (EulerOS-SA-2018-1072)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use...

CVE-2017-2591: Heap-based Buffer Overflow

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniquenessentrytoconfig function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap...

CVE-2017-2803

A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 version 18.1.0.661. A specially crafted TIFF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific TIFF file to trigger this...

CVE-2016-9043

An out of bound write vulnerability exists in the EMF parsing functionality of CorelDRAW X8 CdrGfx - Corel Graphics Engine 64-Bit - 18.1.0.661. A specially crafted EMF file can cause a vulnerability resulting in potential code execution. An attacker can send the victim a specific EMF file to...

Cross site scripting

An out of bound write vulnerability exists in the EMF parsing functionality of CorelDRAW X8 CdrGfx - Corel Graphics Engine 64-Bit - 18.1.0.661. A specially crafted EMF file can cause a vulnerability resulting in potential code execution. An attacker can send the victim a specific EMF file to...

CVE-2016-9043

CorelDRAW X8 EMF parsing (CdrGfx.dll) contains an out-of-bounds write in EMF handling (EMR_CREATEBRUSHINDIRECT and related records), enabling potential memory corruption and code execution. Affected version: CorelDRAW X8 18.1.0.661. Exploitation involves sending a crafted EMF file; remote attacke...

CVE-2017-2804

CVE-2017-2804 is a remote out-of-bounds write in Corel PHOTO‑PAINT X8 (18.1.0.661) TIFF parsing via the IETIF.FLT filter. The TIff IFD/Tag handling can lead to a negative/incorrect size being used in a memcpy, causing memory corruption. Public writeups describe the vulnerability as a memory corru...

CVE-2016-8730

Summary: CVE-2016-8730 is a memory corruption/out-of-bounds write vulnerability in Corel PHOTO-PAINT X8 18.1.0.661 caused by the GIF parsing code (IEGIF.flt). A crafted GIF can trigger code execution. Affected product/component: Corel PHOTO-PAINT X8 (18.1.0.661) GIF parsing. Root cause: out-of-bo...

PT-2018-7194

Name of the Vulnerable Software and Affected Versions: Core PHOTO-PAINT X8 version 18.1.0.661 64-bit Description: A remote out of bound write issue exists in the TIFF parsing functionality, allowing a specially crafted TIFF file to potentially cause memory corruption. An attacker can exploit this...

PT-2018-7195

Name of the Vulnerable Software and Affected Versions: Core PHOTO-PAINT X8 version 18.1.0.661 Description: A remote out of bound write issue exists in the TIFF parsing functionality. This can be triggered by a specially crafted TIFF file, potentially causing memory corruption. An attacker can...

CVE-2014-9990

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 600, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, and SD 450, lack of...