httpd security update

2.4.6-31.0.1.el71.1 - replace index.html with Oracle's index page oracleindex.html 2.4.6-31.1 - core: fix chunk header parsing defect CVE-2015-3183 - core: replace of apsomeauthrequired with apsomeauthnrequired and apforceauthn hook CVE-2015-3185...

Microsoft Office 2007 - MSPTLS Heap Index Integer Underflow (MS15-081)

Microsoft Office 2007 - MSPTLS Heap Index Integer Underflow MS15-081 Source: https://code.google.com/p/google-security-research/issues/detail?id=431&can=1 The following crash was observed in Microsoft Office 2007 with Microsoft Office File Validation Add-In disabled and Application Verifier enabl...

CVE-2015-4479

Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data...

Heap overflow

Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to...

CVE-2015-4493

Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to...

Mozilla: Overflow issues in libstagefright (MFSA 2015-83)

Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data...

UBUNTU-CVE-2015-4479

Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data...

USN-2686-1 apache2 vulnerabilities

It was discovered that the Apache HTTP Server incorrectly parsed chunk headers. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks. CVE-2015-3183 It was discovered that the Apache HTTP Server incorrectly handled the apsomeauthrequired API. A remote attacker...

Heap overflow unlink using the method-vulnerability warning-the black bar safety net

0x01 the first part of the First a brief introduction about the heap chunk structure We may be in malloc. c is found on the heap chunk structure of the code struct mallocchunk INTERNALSIZET prevsize; / Size of previous chunk if free. / INTERNALSIZET size; / Size in bytes, including overhead. /...

DEBIAN-CVE-2015-3183

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension...

UBUNTU-CVE-2015-3183

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension...

apache: multiple issues

CVE-2015-0228 denial of service: modlua: A maliciously crafted websockets PING after a script calls r:wsupgrade can cause a child process crash. - CVE-2015-0253 denial of service: Fix a crash with ErrorDocument 400 pointing to a local URL-path with the INCLUDES filter active, introduced in...

apache22 -- chunk header parsing defect

Apache Foundation reports: CVE-2015-3183 core: Fix chunk header parsing defect. Remove aprbrigadeflatten, buffering and duplicated code from the HTTPIN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters...

DEBIAN-CVE-2015-4141

The WPS UPnP function in hostapd, when using WPS AP, and wpasupplicant, when using WPS external registrar ER, 0.7.0 through 2.4 allows remote attackers to cause a denial of service crash via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow...

UBUNTU-CVE-2015-4468

Multiple integer overflows in the searchchunk function in chmd.c in libmspack before 0.5 allow remote attackers to cause a denial of service buffer over-read and application crash via a crafted CHM file...

Libmimedir VCF Memory Corruption Proof Of Concept

!/usr/bin/python libmimedir-free.py Libmimedir VCF Memory Corruption PoC CVE-2015-3205 Jeremy Brown jbrown3264/gmail June 2015 -Synopsis- Adding two NULL bytes to the end of a VCF file allows a user to manipulate free calls which occur during it's lexer's memory clean-up procedure. This could lea...

PT-2015-6599

Name of the Vulnerable Software and Affected Versions libmspack versions prior to 0.5 Description The issue is related to multiple integer overflows in the search chunk function in chmd.c. This allows remote attackers to cause a denial of service, resulting in a buffer over-read and application...

Libmimedir VCF Memory Corruption PoC

Libmimedir suffers from a memory corruption vulnerability. Adding two NULL bytes to the end of a VCF file allows a user to manipulate free calls which occur during it's lexer's memory clean-up procedure. This could lead to exploitable conditions such as crafting a specific memory chunk to allow f...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2015:0068-1)

The SUSE Linux Enterprise 12 kernel was updated to 3.12.31 to receive various security and bugfixes. Security issues fixed: CVE-2014-9322: A local privilege escalation in the x8664 32bit compatibility signal handling was fixed, which could be used by local attackers to crash the machine or execut...

Adobe Shockwave Player Chunk Parsing Out of Bounds (APSB12-13) - Ver2 (CVE-2012-2031)

A remote code execution vulnerability has been reported in Adobe Shockwave player. The vulnerability is due to a memory corruption error while parsing crafted data in an rcsL chunk within a DIR media file. A remote attacker can exploit this issue by enticing a target user to open a specially...