FaceTime - readSPSandGetDecoderParams Stack Corruption

FaceTime - readSPSandGetDecoderParams Stack Corruption There are a variety of problems that occur when processing malformed H264 streams in readSPSandGetDecoderParams, leading to OOB read, OOB write and stackchk crashes. I think the root cause is stack corruption. This issue can occur if someone...

FreeBSD : FreeBSD -- Heap overflow vulnerability in bspatch (ce808022-8ee6-11e6-a590-14dae9d210b8)

The implementation of bspatch is susceptible to integer overflows with carefully crafted input, potentially allowing an attacker who can control the patch file to write at arbitrary locations in the heap. This issue was partially addressed in FreeBSD-SA-16:25.bspatch, but some possible integer...

FreeBSD -- Heap overflow vulnerability in bspatch

Problem Description: The implementation of bspatch is susceptible to integer overflows with carefully crafted input, potentially allowing an attacker who can control the patch file to write at arbitrary locations in the heap. This issue was partially addressed in FreeBSD-SA-16:25.bspatch, but som...

FreeBSD-SA-16:29.bspatch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-16:29.bspatch Security Advisory The FreeBSD Project Topic: Heap overflow vulnerability in bspatch Category: core Module: bsdiff Announced: 2016-10-10 Affects:...

FreeBSD bspatch Utility Remote Code Execution (CVE-2014-9862)

A remote code execution vulnerability has been reported in the bspatch utility in FreeBSD. The vulnerability is due to improper validation on the numbers of bytes to read from diff and extra stream values. A remote attacker can exploit this vulnerability by enticing the target user to download an...

FreeBSD : FreeBSD -- Heap vulnerability in bspatch (7d4f4955-600a-11e6-a6c3-14dae9d210b8)

The implementation of bspatch does not check for a negative value on numbers of bytes read from the diff and extra streams, allowing an attacker who can control the patch file to write at arbitrary locations in the heap. This issue was first discovered by The Chromium Project and reported...

FreeBSD-SA-16:25.bspatch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-16:25.bspatch Security Advisory The FreeBSD Project Topic: Heap vulnerability in bspatch Category: core Module: bsdiff Announced: 2016-07-25 Affects: All...

FreeBSD -- Heap vulnerability in bspatch

Problem Description: The implementation of bspatch does not check for a negative value on numbers of bytes read from the diff and extra streams, allowing an attacker who can control the patch file to write at arbitrary locations in the heap. This issue was first discovered by The Chromium Project...

CVE-2014-9862

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service heap-based buffer overflow via a crafted patch file...