Apple macOS/iOS - 'CAMediaTimingFunctionBuiltin' NSKeyedArchiver Memory Corruption Due to Lack of Bounds Checking

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1175 CAMediaTimingFunctionBuiltin is a class in QuartzCore. Its initWithCoder: method reads an Int "index" then passes that to builtinfunction mov ebx, edi -- controlled unsigned int mov r14d, ebx lea r15, ZL9functions0 ; functions...

Apple macOS/iOS Kernel - Memory Disclosure Due to Lack of Bounds Checking in netagent Socket Option Handling

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1140 netagentctlsetopt is the setsockopt handler for netagent control sockets. Options of type NETAGENTOPTIONTYPEREGISTER are handled by netagenthandleregistersetopt. Here's the code: static errnot...

Sync Breeze Enterprise GET Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Sync Breeze Enterprise GET Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerability in the web...

CVE-2017-9055

An issue, also known as DW201703-001, was discovered in libdwarf 2017-03-21. In dwarfformsdata a few data types were not checked for being in bounds, leading to a heap-based buffer over-read...

About the security content of watchOS 3.1.3 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

Dup Scout Enterprise 9.5.14 - GET Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Dup Scout Enterprise GET Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerability ...

ALLPlayer M3U File Stack Buffer Overflow (CVE-2013-7409)

A stack buffer overflow vulnerability exists in ALLPlayer. The vulnerability is due to insufficient bounds checking on a M3U file. A remote attacker could exploit this vulnerability by enticing a victim to open a specially crafted M3U file. Successful exploitation could lead to arbitrary code...

EulerOS 2.0 SP1 : squid (EulerOS-SA-2016-1056)

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of...

Zinf Audio Player PLS File Stack Buffer Overflow (CVE-2004-0964)

A stack buffer overflow vulnerability exists in Zinf Audio Player 2.2.1. The vulnerability is due to insufficient bounds checking on a PLS file. A remote attacker could exploit this vulnerability by enticing a victim to open a specially crafted PLS file. Successful exploitation could lead to...

Rockwell Automation Logix Controller Stack Buffer Overflow (CVE-2016-9343)

A stack buffer overflow vulnerability exists in Rockwell Automation Logix Controllers. The vulnerability is due to insufficient bounds checking. A successful exploitation could lead to arbitrary code execution...

Disk Sorter Enterprise 9.5.12 GET Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Disk Sorter Enterprise GET Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerabilit...

Mini-Stream RM-MP3 Converter PLS File Stack Buffer Overflow

A stack buffer overflow vulnerability exists in Mini-Stream RM-MP3 Converter. The vulnerability is due to insufficient bounds checking on a PLS file. A remote attacker could exploit this vulnerability by enticing a victim to open a specially crafted PLS file. Successful exploitation could lead to...

SUSE SLED12 / SLES12 Security Update : gstreamer-plugins-bad (SUSE-SU-2017:0962-1)

This update for gstreamer-plugins-bad fixes the following issues: Security issues fixed : - CVE-2017-5843: set stream tags to NULL after unrefing bsc1024044. - CVE-2017-5848: rewrite PSM parsing to add bounds checking bsc1024068. Note that Tenable Network Security has extracted the preceding...

SUSE-SU-2017:0962-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues: Security issues fixed: - CVE-2017-5843: set stream tags to NULL after unrefing bsc1024044. - CVE-2017-5848: rewrite PSM parsing to add bounds checking bsc1024068...

macOS Kernel 10.12.2 (16C67) - Memory Disclosure Due to Lack of Bounds Checking in AppleIntelCapriCo

Exploit for macOS platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1069 MacOS kernel memory disclosure due to lack of bounds checking in AppleIntelCapriController::getDisplayPipeCapability Selector 0x710 of IntelFBClientControl ends up in...

Cain And Abel RDP File Stack Buffer Overflow (CVE-2008-5405)

A stack-based buffer overflow exists in Oxid Cain and Abel. The vulnerability is due to insufficient bounds checking on a RDP file. A remote attacker could exploit this vulnerability by enticing a victim to open a specially crafted RDP file. Successful exploitation could allow administrator acces...

MacOS/iOS kernel memory corruption due to bad bounds checking in necp_client_copy_interface（CVE-2017-2473）

necpclientcopyinterface contains this code where interfaceindex is an attacker controlled a uint32t that: if interfaceindex != IFSCOPENONE && intinterfaceindex = ifindex interface = ifindex2ifnetinterfaceindex; This leads to an interface pointer being read out of bounds. This can lead to kernel...

Apple macOS/iOS Kernel 10.12.3 (16D32) - SIOCSIFORDER Socket ioctl Memory Corruption Due to Bad Bounds Checking

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1108 SIOCSIFORDER is a new ioctl added in iOS 10. It can be called on a regular tcp socket, so from pretty much any sandbox. it falls through to calling: ifnetresetorderorderedindices, ifo-ifocount where orderedindicies points to...

Apple macOSiOS Kernel 10.12.3 (16D32) - SIOCSIFORDER Socket ioctl Memory Corruption Due to Bad Bounds Checking

Apple macOSiOS Kernel 10.12.3 16D32 - SIOCSIFORDER Socket ioctl Memory Corruption Due to Bad Bounds Checking / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1108 SIOCSIFORDER is a new ioctl added in iOS 10. It can be called on a regular tcp socket, so from pretty much any...

Apple macOS Kernel 10.12.2 (16C67) - AppleIntelCapriController::GetLinkConfig Code Execution Due to Lack of Bounds Checking

Apple macOS Kernel 10.12.2 16C67 - AppleIntelCapriController::GetLinkConfig Code Execution Due to Lack of Bounds Checking / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1071 Selector 0x921 of IntelFBClientControl ends up in AppleIntelCapriController::GetLinkConfig This method...