GDB DWARF多个缓冲区溢出漏洞

GDB是一个用来调试C和C++程序的强力调试器。 GDB的DWARF和DWARF2代码中存在多个缓冲区溢出漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。 DWARF规范允许使用包含有操作列表的位置描述块确定一些调试符的最终真实地址。GDB在一个未经检查的64字节栈缓冲区执行这些操作，这就允许任何包含有多于64个操作的位置块（DWFORMblock）使用用户数据覆盖当前的栈帧。dwarfread.c和dwarfread2.c中都存在这个问题。 GNU GDB 6.0 - 6.4 不要使用GDB调试可能包含有DWARF2调试信息的不可信任文件。 厂商补丁： GNU ---...

USN-356-1: gdb vulnerability

Will Drewry, of the Google Security Team, discovered buffer overflows in GDB's DWARF processing. This would allow an attacker to execute arbitrary code with user privileges by tricking the user into using GDB to load an executable that contained malicious debugging information...

[SA21713] GDB "DWARF" Buffer Overflow Vulnerabilities

TITLE: GDB "DWARF" Buffer Overflow Vulnerabilities SECUNIA ADVISORY ID: SA21713 VERIFY ADVISORY: http://secunia.com/advisories/21713/ CRITICAL: Less critical IMPACT: DoS, System access WHERE: From remote SOFTWARE: GDB 6.x http://secunia.com/product/5137/ DESCRIPTION: Will Drewry has reported some...

GDB GNU debugger buffer overflow

Buffer overflow on DWARF section parsing...

CVE-2006-4146

Buffer overflow in the 1 DWARF dwarfread.c and 2 DWARF2 dwarf2read.c debugging code in GNU Debugger GDB 6.5 allows user-assisted attackers, or restricted users, to execute arbitrary code via a crafted file with a location block DWFORMblock that contains a large number of operations...

CVE-2006-4146

Buffer overflow in the 1 DWARF dwarfread.c and 2 DWARF2 dwarf2read.c debugging code in GNU Debugger GDB 6.5 allows user-assisted attackers, or restricted users, to execute arbitrary code via a crafted file with a location block DWFORMblock that contains a large number of operations...

DEBIAN-CVE-2006-4146

Buffer overflow in the 1 DWARF dwarfread.c and 2 DWARF2 dwarf2read.c debugging code in GNU Debugger GDB 6.5 allows user-assisted attackers, or restricted users, to execute arbitrary code via a crafted file with a location block DWFORMblock that contains a large number of operations...

CVE-2006-4146

CVE-2006-4146 describes a buffer overflow in GDB 6.5 affecting the DWARF and DWARF2 debugging code (dwarfread.c and dwarf2read.c). A crafted file with a DW_FORM_block containing a large number of operations can allow user‑assisted or restricted users to execute arbitrary code. The issue arises fr...

CVE-2006-0820

Cross-site scripting XSS vulnerability in Dwarf HTTP Server 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified error messages...

Cross site scripting

Cross-site scripting XSS vulnerability in Dwarf HTTP Server 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified error messages...

CVE-2006-0820

CVE-2006-0820 affects the Dwarf HTTP Server (version 1.3.2). The vulnerability group includes two issues: (1) cross-site scripting via error messages, allowing remote attackers to inject arbitrary HTML/script in users’ browsers, and (2) a filename-extension validation flaw that can disclose sourc...

Multiple Dwarf HTTP Server vulnerabilities

Crossite scripting, scripts source code disclosure...

Secunia Research: Dwarf HTTP Server Source Disclosure and Cross-Site Scripting

====================================================================== Secunia Research 13/03/2006 - Dwarf HTTP Server Source Disclosure and Cross-Site Scripting - ====================================================================== Table of Contents Affected...