FreeBSD / Apple libc link_ntoa() buffer overflow Exploit

Exploit for multiple platform in category remote exploits Improper bounds checking of the obuf variable in the linkntoa function in linkaddr.c may allow an attacker to read or write from memory. The routine linkaddr interprets character strings representing link-level addresses, returning binary...

Memcached process_bin_sasl_auth Integer Underflow (CVE-2016-8706)

An integer underflow vulnerability exists in the Memcached binary protocol. This vulnerability is due to a lack of bounds checking in the processbinsaslauth function. A remote unauthenticated attacker can exploit these vulnerabilities by sending a specially crafted packet to memcached that can le...

Memcached process_bin_append_prepend Integer Overflow (CVE-2016-8704)

An integer overflow vulnerability exists in memcached. This vulnerability is due to a lack of bounds checking in the processbinappendprepend function while processing commands that append or prepend data to existing key-value pairs. A remote unauthenticated attacker can exploit these...

DiskBoss Enterprise GET Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in the web interface of DiskBoss Enterprise v7.5.12, v7.4.28, and v8.2.14, caused by improper bounds checking of the request path in HTTP GET requests sent to the built-in web server. This module has been tested successfully on...

BlueZ buffer overflow vulnerability (CNVD-2016-11950)

BlueZ is an official Bluetooth stack for Linux. A buffer overflow vulnerability exists in the 'pincodereplydump' function in the tools/parser/hci.c source file of BlueZ version 5.42, which stems from the program's failure to perform sufficient bounds checking on parameters. An attacker could...

DiskSavvy Enterprise GET Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in the web interface of DiskSavvy Enterprise v9.1.14 and v9.3.14, caused by improper bounds checking of the request path in HTTP GET requests sent to the built-in web server. This module has been tested successfully on Windows XP SP...

Mozilla Firefox integer overflow vulnerability (CNVD-2016-11474)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. Mozilla Firefox has a security vulnerability. Potential integer overflow or other bounds-checking issues due to incorrect parameter length checking in JavaScript...

CVE-2016-5297

An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird 45.5, Firefox ESR 45.5, and Firefox 50...

CVE-2016-5297

An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird 45.5, Firefox ESR 45.5, and Firefox 50...

Linux Kernel Local Buffer Overflow Vulnerability

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. The Linux Kernel suffers from a local buffer overflow vulnerability due to the program failing to adequately perform bounds checking on user input. Allowing an attacker to...

NVIDIA Driver - No Bounds Checking in Escape 0x7000170 Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=936 The DxgkDdiEscape handler for 0x7000170 lacks proper bounds checks for the variable size input escape data, and relies on a user provided size as the upper bound for writing...

NVIDIA Driver - No Bounds Checking in Escape 0x7000194 Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=895 The DxgkDdiEscape handler for 0x7000194 doesn't do bounds checking with the user provided lengths it receives. When these lengths are passed to memcpy, overreads and memory...

NVIDIA Driver - No Bounds Checking in Escape 0x7000170

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=936 The DxgkDdiEscape handler for 0x7000170 lacks proper bounds checks for the variable size input escape data, and relies on a user provided size as the upper bound for writing output. Crashing context with PoC Win 10 x64 with...

NVIDIA Driver - No Bounds Checking in Escape 0x7000194

NVIDIA Driver - No Bounds Checking in Escape 0x7000194 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=895 The DxgkDdiEscape handler for 0x7000194 doesn't do bounds checking with the user provided lengths it receives. When these lengths are passed to memcpy, overreads and memory...

libgd 'gd_webp.c' Integer Overflow Vulnerability

libgd also known as GD Graphics Library or libgd2 is an American software developer Thomas Boutell developed an open source library for dynamic image creation, which supports the creation of charts, graphs and thumbnails and so on. An integer overflow vulnerability exists in libgd version 2.2.3,...

SAP NetWeaver SAPSTARTSRV Remote Buffer Overflow Vulnerability

SAP NetWeaver is an integrated, service-oriented application platform that provides a development and runtime environment for SAP applications. A remote buffer overflow vulnerability exists in SAP NetWeaver SAPSTARTSRV due to the program failing to adequately filter the bounds-check parameter. An...

Lexmark Perceptive Document Filters Stack Buffer Overflow Vulnerability (CNVD-2016-06324)

Lexmark Perceptive Document Filters is an SDK for converting unstructured documents from Lexmark USA. A stack buffer overflow vulnerability exists in Lexmark Perceptive Document Filters, which stems from the program's failure to perform bounds checking on user-submitted input. A remote attacker...

Hancom Hangul Office HShow!NXDeleteLineObj+0x53692 Code Execution Vulnerability

Talos Vulnerability Report TALOS-2016-0146 Hancom Hangul Office HShow!NXDeleteLineObj+0x53692 Code Execution Vulnerability August 4, 2016 CVE Number CVE-2016-4291 Description This vulnerability was discovered within the Hangul HShow application which is part of the Hangul Office Suite. Hangul...

Type confusion in display transformation — Mozilla

Using the Address Sanitizer tool, security researcher Nils reported a type confusion flaw in display transformation during rendering due to incorrect bounds checking. This leads to a potentially exploitable crash and can be triggered by web content...

Fedora 23 : 2:qemu (2016-f2b1f07256)

CVE-2016-3710: incorrect bounds checking in vga bz 1334345 - CVE-2016-3712: out of bounds read in vga bz 1334342 - Fix USB redirection bz 1330221 - CVE-2016-4037: infinite loop in usb ehci bz 1328080 - CVE-2016-4001: buffer overflow in stellaris net bz 1325885 - CVE-2016-2858: rng stack...