HackerOne: PNG compression DoS

ztxt: http://www.libpng.org/pub/png/spec/1.1/PNG-Chunks.htmlC.zTXt "zTXT Documentation" tech: http://www.zlib.net/zlibtech.html "zlib technical details" zlibvuln1: http://www.kb.cert.org/vuls/id/680620 zlibvuln2: http://www.kb.cert.org/vuls/id/238678 PNG compression DoS ---------------------...

CVE-2013-0865

The vqadecodechunk function in libavcodec/vqavideo.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large 1 cbp0 or 2 cbpz chunk in Westwood Studios VQA Video file, which triggers an out-of-bounds write...

Stack overflow

The sctpsendinitiateack function in sys/netinet/sctpoutput.c in the SCTP implementation in the kernel in FreeBSD 8.3 through 9.2-PRERELEASE does not properly initialize the state-cookie data structure, which allows remote attackers to obtain sensitive information from kernel stack memory by readi...

CVE-2013-5209

Removed by vendor...

FreeBSD Kernel SCTP Denial Of Service

/ FreeBSD kernel SCTP latest release remote NULL ptr dereference DoS by Shaun Colley , 2 Aug 2012 The SCTP implementation used by FreeBSD "reference implementation" is vulnerable to a remote NULL pointer dereference in kernel due to a logic bug. When parsing ASCONF chunks, an attempt is made to...

FreeBSD - SCTP Remote NULL Ptr Dereference Denial of Service

/ FreeBSD kernel SCTP latest release remote NULL ptr dereference DoS by Shaun Colley , 2 Aug 2012 The SCTP implementation used by FreeBSD "reference implementation" is vulnerable to a remote NULL pointer dereference in kernel due to a logic bug. When parsing ASCONF chunks, an attempt is made to...

USN-1402-1: libpng vulnerability

It was discovered that libpng did not properly process compressed chunks. If a user or automated system using libpng were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or execute code with the privileges of the user invoking the progra...

Sunway ForceControl SNMP NetDBServer Data Chunk Copy Buffer Overflow

Added: 02/22/2012 BID: 49747 OSVDB: 75798 Background Sunway ForceControl is a Chinese SCADA/HMI software application widely used in China to help run weapons systems, utilities and chemical plants. It is also used to a lesser extent in other countries, including the US. SNMP NetDBServer is one of...

Sunway ForceControl SNMP NetDBServer Data Chunk Copy Buffer Overflow

Added: 02/22/2012 BID: 49747 OSVDB: 75798 Background Sunway ForceControl is a Chinese SCADA/HMI software application widely used in China to help run weapons systems, utilities and chemical plants. It is also used to a lesser extent in other countries, including the US. SNMP NetDBServer is one of...

USN-1367-1: libpng vulnerabilities

It was discovered that libpng did not properly verify the embedded profile length of iCCP chunks. An attacker could exploit this to cause a denial of service via application crash. This issue only affected Ubuntu 8.04 LTS. CVE-2009-5063 Jueri Aedla discovered that libpng did not properly verify t...

iax2-brute NSE Script

Performs brute force password auditing against the Asterisk IAX2 protocol. Guessing fails when a large number of attempts is made due to the maxcallnumber limit default 2048. In case your getting "ERROR: Too many retries, aborted ..." after a while, this is most likely what's happening. In order ...

Adobe Shockwave Player Multiple Vulnerabilities (Windows) - Nov 2011

This host is installed with Adobe Shockwave Player and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbadobeshockwaveplayermultvulnnov11win.nasl 5424 2017-02-25 16:52:36Z teissa $ Adobe Shockwave Player Multiple Vulnerabilities Windows - Nov 2011 Authors: Madhuri D...

Buffer overflow

Multiple buffer overflows in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code via vectors related to 1 NAME, 2 PLYR, 3 CHTS, or 4 AIPL aka AI config chunk loading from a savegame...

libpng: Invalid read when handling empty sCAL chunks

The pnghandlesCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service memory corruption and application crash or possibly have...

libpng: Invalid read when handling empty sCAL chunks

The pnghandlesCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service memory corruption and application crash or possibly have...

CVE-2011-2692

The pnghandlesCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service memory corruption and application crash or possibly have...

Adobe Shockwave Director tSAC Chunk String Termination Memory Corruption (CVE-2011-2118)

A memory corruption vulnerability has been reported in Adobe Shockwave Player. The vulnerability is due to an error in the way that Adobe Shockwave Player processes tSAC chunks in specially crafted Director files. Remote attackers can exploit this vulnerability by enticing a target user to open a...

PT-2011-1110

Name of the Vulnerable Software and Affected Versions libpng versions prior to 1.0.55 libpng versions prior to 1.2.45 libpng versions prior to 1.4.8 libpng versions prior to 1.5.4 libpng versions prior to 1.5.10 Description The issue is related to the handling of invalid sCAL chunks in PNG images...

Adobe Shockwave Player Lnam Chunk Processing Buffer Overflow (APSB10-25; CVE-2010-3655)

A code execution vulnerability has been identified in Adobe Shockwave Player. The vulnerability is due to an error in Adobe Shockwave Player while parsing stringArray structures inside Lman chunks in crafted Director files. A remote attacker can exploit this issue by enticing a user to open a...

Adobe Audition Session File TRKM Stack Buffer Overflow (APSB11-10; CVE-2011-0615)

Adobe Audition formerly Cool Edit Pro is a digital audio workstation from Adobe Systems featuring both a multi-track, non-destructive mix/edit environment and a destructive-approach waveform editing view. A stack buffer overflow exists in Adobe Audition. The vulnerability is due to an error when...