xen-kernel -- broken check in memory_exchange() permits PV guest breakout

The Xen Project reports: The XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays. A malicious or buggy 64-bit PV guest may be able to access all of system memory, allowing fo...

The vulnerability of the QEMU hardware emulation software allows a hacker to trigger a service failure or increase their privileges in the guest operating system.

The vulnerability of the QEMU hardware emulation software arises from synchronization errors when using a shared resource. Exploiting this vulnerability can allow a remote attacker to cause service failures or increase their privileges in the guest operating system...

CVE-2016-8792

Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C01B386; Mate S phones with software Versions before CRR-CL00C92B368, Versions before CRR-CL20C92B368, Versions before CRR-TL00C01B368,...

CVE-2016-8791

CVE-2016-8791 affects Huawei Mate 8, Mate S and P8 devices with specific pre-patch firmware versions (Mate 8: NXT-AL10C00B386, NXT-CL00C92B386, NXT-DL00C17B386, NXT-TL00C01B386; Mate S: CRR-CL00C92B368, CRR-CL20C92B368, CRR-TL00C01B368, CRR-UL00C00B368, CRR-UL20C00B368; P8: GRA-TL00C01B366, GRA-C...

CVE-2016-8793

Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C01B386; Mate S phones with software Versions before CRR-CL00C92B368, Versions before CRR-CL20C92B368, Versions before CRR-TL00C01B368,...

[SECURITY] [DSA 3798-2] tnef regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3798-2 [email protected] https://www.debian.org/security/ Sebastien Delafond March 29, 2017 https://www.debian.org/security/faq -...

CVE-2017-6969

readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well...

CVE-2017-7226

The peILFobjectp function in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2lin...

icoutils: Buffer overflow in the decode_ne_resource_id function

A vulnerability was found in icoutils, in the wrestool program. An attacker could create a crafted executable that, when read by wrestool, could result in memory corruption leading to a crash or potential code execution...

ImageMagick 'ReadRLEImage' function buffer overflow vulnerability

ImageMagick is a set of open source image processing software. A buffer overflow vulnerability exists in the 'ReadRLEImage' function of ImageMagick's coders/rle.c file. An attacker can exploit this vulnerability to construct a malicious file and trick the application into parsing it, crashing the...

ImageMagick xpm File Denial of Service Vulnerability

ImageMagick is a set of open source image processing software. A security vulnerability exists in ImageMagick. An attacker could exploit the vulnerability by submitting a special xpm file that would trick the application into parsing it, crashing the application...

Heap overflow

The peILFobjectp function in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2lin...

CVE-2017-7226

The peILFobjectp function in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2lin...

CVE-2017-7226

The peILFobjectp function in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2lin...

CVE-2017-7226

The peILFobjectp function in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2lin...

Winamp Maki File Buffer Overflow (CVE-2009-1831)

A buffer overflow vulnerability has been reported in Nullsoft Winamp. The vulnerability is due to an incorrect type cast while parsing a .maki file, causing a buffer overflow. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected...

quagga: Telnet interface input buffer allocates unbounded amounts of memory

A denial of service flaw affecting various daemons in Quagga was found. A remote attacker could use this flaw to cause the various Quagga daemons, which expose their telnet interface, to crash...

Microsoft Windows Kernel - Registry Hive Loading Crashes in nt!nt!HvpGetBinMemAlloc and nt!ExpFindAn

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=993 We have encountered Windows kernel crashes in the internal nt!nt!HvpGetBinMemAlloc and nt!ExpFindAndRemoveTagBigPages functions while loading corrupted registry hive files. We...

Microsoft Windows - Uniscribe Font Processing Multiple Heap-Based Out-of-Bounds and Wild Reads (MS17

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1031 Through fuzzing, we have discovered a number of different crashes in the Windows Uniscribe user-mode library, while trying to display text using a corrupted font file or calli...

Microsoft Windows Kernel - Registry Hive Loading Crashes in nt!nt!HvpGetBinMemAlloc / nt!ExpFindAndRemoveTagBigPages (MS17-017)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=993 We have encountered Windows kernel crashes in the internal nt!nt!HvpGetBinMemAlloc and nt!ExpFindAndRemoveTagBigPages functions while loading corrupted registry hive files. We believe both crashes to be caused by the same bug...