One font vulnerability to rule them all #3: Windows 8.1 32-bit sandbox escape exploitation

Posted by Mateusz Jurczyk of Google Project Zero This is part 3 of the “One font vulnerability to rule them all” blog post series. In the previous posts, we introduced the “blend” PostScript operator vulnerability, discussed the Charstring primitives necessary to fully control the stack contents...

OpenAFS Denial of Service Vulnerability (CNVD-2015-05292)

OpenAFS is a distributed file system that allows sharing of archives and resources between systems over LANs and WANs. A security vulnerability exists in the pioctl support for the OSD FS command in IBM OpenAFS 1.6.12 and earlier versions, which stems from a program writing the result of an RPC...

CVE-2015-3636

The pingunhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service use-after-free and system crash by leveraging the ability to make a...

php5 -- multiple vulnerabilities

The PHP project reports: Core: Fixed bug 69793 Remotely triggerable stack exhaustion via recursive method calls. Fixed bug 70121 unserialize could lead to unexpected methods execution / NULL pointer deref. OpenSSL: Fixed bug 70014 opensslrandompseudobytes is not cryptographically secure. Phar:...

OpenJDK: RemoteObjectInvocationHandler allows calling finalize() (RMI, 8076409)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI...

UBUNTU-CVE-2015-1333

Memory leak in the keylinkend function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service memory consumption via many addkey system calls that refer to existing keys...

WhatsApp, Viber and Skype Internet Calls may No Longer be FREE in India

We all are aware of Net Neutrality and the recent controversies over it in India. Net Neutrality is simply the Internet Freedom — Free, Fast and Open Internet for all. India has been battling for Net Neutrality since zero-rating services such as Facebook’s Internet.org and Airtel Zero were...

OpenJDK: RemoteObjectInvocationHandler allows calling finalize() (RMI, 8076409)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI...

MS15-058: Vulnerabilities in SQL Server Could Allow Remote Code Execution (3065718) (uncredentialed check)

The remote Microsoft SQL Server installation is affected by multiple vulnerabilities : - A privilege escalation vulnerability exists due to the casting of pointers to an incorrect class. An authenticated, remote attacker can exploit this, via a specially crafted SQL query, to gain elevated...

File Roller v3.4.1 - Denial of Service (PoC)

File Roller v3.4.1 - Denial of Service PoC !/usr/bin/perl Title: File Roller - DoS PoC Date: 08/07/2015 Author: Arsyntex Homepage: https://wiki.gnome.org/Apps/FileRoller Version: v3.4.1 Tested on: Linux lab 3.2.0-85-generic-pae 122-Ubuntu i686 i386 GNU/Linux...

Apple iOS Webkit SQLite authorizer arbitrary SQL function call vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. An insufficient comparison vulnerability in the Apple iOS Webkit SQLite authorizer allows remote attackers to construct a malicious WEB page that can be called with arbitrary SQL functions by tricking the...

PT-2015-6098 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.1.2 Description: The issue is related to a race condition in the Linux kernel, specifically in the net/sctp/socket.c file. This condition allows local users to cause a denial of service, resulting in list...

CVE-2015-3212

Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service list corruption and panic via a rapid series of system calls related to sockets, as demonstrated by setsockopt calls...

AVG Internet Security 2013.x < 2013.3495 / 2015.x < 2015.5557 Local Privilege Escalation

The remote Windows host has a version of AVG Internet Security installed that is 2013.x prior to 2013.3495 or 2015.x prior to 2015.5557. It is, therefore, affected by a local privilege escalation vulnerability due to a flaw in the TDI driver avgtdix.sys that occurs when handling 0x830020f8 IOCTL...

You Can Now Use Messenger App without a Facebook Account

Don't have Facebook account but want to use its Messenger service? Then go for it because Mark Zuckerberg wants even the people who hate Facebook to use the social network's separate Messenger service. So, you no longer need an active Facebook account to make use of the Messenger service, all you...

The vulnerability of the Windows operating system allows a malicious individual to obtain user authentication information.

The vulnerability of the Windows operating system exists in the implementation of system calls such as URLDownloadA, URLDownloadW, URLDownloadToCacheFileA, URLDownloadToCacheFileW, URLDownloadToFileA, URLDownloadToFileW, URLOpenStream, and URLOpenBlockingStream. During these calls, the operating...

CVE-2015-3205

libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file, related to "free" function calls in the "lexer's memory clean-up procedure."...

Libmimedir VCF Memory Corruption PoC

Libmimedir suffers from a memory corruption vulnerability. Adding two NULL bytes to the end of a VCF file allows a user to manipulate free calls which occur during it's lexer's memory clean-up procedure. This could lead to exploitable conditions such as crafting a specific memory chunk to allow f...

DEBIAN-CVE-2015-3903

libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information...

UBUNTU-CVE-2015-3903

libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information...