2318 matches found
glibc - NUL Byte gconv_translit_find Off-by-One
glibc - NUL Byte gconvtranslitfind Off-by-One // // Full Exploit: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/34421.tar.gz CVE-2014-5119.tar.gz // // // --------------------------------------------------- // CVE-2014-5119 glibc gconvtranslitfind exploit //...
libpng: unhandled zero-length PLTE chunk or NULL palette
The pngdoexpandpalette function in libpng before 1.6.8 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via 1 a PLTE chunk of zero bytes or 2 a NULL palette, related to pngrtran.c and pngset.c...
DjVuLibre 3.5.25.3 - Out of Bounds Access Violation
from shutil import copyfile import sys """ Exploit Title: DjVuLibre .text:004D3BC5 mov eax, eax+ecx4 .text:004D3BC8 test eax, eax .text:004D3BCA jnz short loc We overwrite 4 bytes in an FG44 chunk header with \xff\xff\xff\xff: 46 47 34 34 00 00 04 6E 00 64 01 02 FF FF FF FF 80 FF...
Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to...
Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to...
Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to...
Adobe Shockwave Director tSAC - Chunk Memory Corruption
No description provided by source. ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ ''' ''' Title : Adobe Shockwave Director tSAC Chunk memory corruption Version : dirapi.dll 11.5.7 Analysis : http://www.abysssec.com Vendor...
Clam AntiVirus <= 0.88.4 CHM Chunk Name Length DoS PoC
No description provided by source. !/usr/bin/perl Clam AntiVirus ClamAV CHM Chunk Name Length DoS Vulnerability Took Damian Put's poc and shortened it just a little. All credits to Damian Put pucikatgazeta.pl [email protected] www.overflow.pl /str0ke my $clam =...
Microsoft Reader <= 2.1.1.3143 Array Overflow
No description provided by source. Source: http://aluigi.org/adv/msreader4-adv.txt Luigi Auriemma Application: Microsoft Reader http://www.microsoft.com/reader Versions: = 2.1.1.3143 PC version = 2.6.1.7169 Origami version the non-PC versions have not been tested Platforms: Windows, Windows Mobil...
Samba 3.0.21-3.0.24 - LSA trans names Heap Overflow
No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...
Samba chain_reply Memory Corruption (Linux x86)
No description provided by source. $Id: chainreply.rb 10238 2010-09-04 02:10:22Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
MPG123 0.59 Remote File Play Heap Corruption Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8680/info A problem in the handling of some types of remote files has been reported in mpg123. Because of this, it may be possible for a remote attacker to execute arbitrary code with the privileges of the mpg123 user. /...
Qemu: prevent possible buffer overflows
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service crash or possibly execute arbitrary code via a large 1 L1 table in the qcow2snapshotloadtmp in the QCOW 2 block driver block/qcow2-snapshot.c or 2 uncompressed chunk, 3 chunk length...
Integer overflow
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service resource consumption via a malformed chunk size in chunke...
CVE-2014-0075
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service resource consumption via a malformed chunk size in chunke...
UBUNTU-CVE-2014-0075
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service resource consumption via a malformed chunk size in chunke...
tomcat: incomplete fix for CVE-2012-3544
It was discovered that the fix for CVE-2012-3544 did not properly resolve a denial of service flaw in the way Tomcat and JBoss Web processed chunk extensions and trailing headers in chunked requests. A remote attacker could use this flaw to send an excessively long request that, when processed by...
tomcat: incomplete fix for CVE-2012-3544
It was discovered that the fix for CVE-2012-3544 did not properly resolve a denial of service flaw in the way Tomcat and JBoss Web processed chunk extensions and trailing headers in chunked requests. A remote attacker could use this flaw to send an excessively long request that, when processed by...
wireshark: DoS (infinite loop) in the SCTP dissector (wnpa-sec-2012-33)
Integer overflow in the dissectsackchunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service infinite loop via a crafted Duplicate TSN count...
Updated libpng package fixes security vulnerability
The pngpushreadchunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service infinite loop and CPU consumption via an IDAT chunk with a length of zero CVE-2014-0333...