CVE-2018-7998

In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vipsregiongenerate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race conditi...

Race condition

In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vipsregiongenerate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race conditi...

Remote code execution

An Arbitrary Free Remote Code Execution issue was discovered in Design Science MathType 6.9c. Crafted input can overwrite a structure, leading to a function call with an invalid parameter, and a subsequent free of important data such as a function pointer or list pointer. This is fixed in 6.9d...

CVE-2018-6641

An Arbitrary Free Remote Code Execution issue was discovered in Design Science MathType 6.9c. Crafted input can overwrite a structure, leading to a function call with an invalid parameter, and a subsequent free of important data such as a function pointer or list pointer. This is fixed in 6.9d...

Smiths Medical Medfusion 4000 - DHCP Denial of Service

Smiths Medical Medfusion 4000 - DHCP Denial of Service !/usr/bin/python3 """PoC for MQX RTCS code execution via DHCP options overflow. This is just a quick hack to prove the vulnerability and was designed to run on a private network with the target device. """ import datetime import socket def...

CVE-2017-6264

CVE-2017-6264 is an elevation-of-privilege vulnerability in the NVIDIA GPU driver used on Android, specifically within the gm20b_clk_throt_set_cdev_state path. An out-of-bounds memory read can be used as a function pointer, potentially allowing a local attacker to execute arbitrary code in kernel...

yara/rules_fuzzer: Incorrect-function-pointer-type in _start

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=4674537548414976 Project: yara Fuzzer: libFuzzeryararulesfuzzer Fuzz target binary: rulesfuzzer Job Type: libfuzzerubsanyara Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash...

boringssl: Incorrect-function-pointer-type in bssl::ext_npn_parse_serverhello

Project: https://boringssl.googlesource.com/boringssl Detailed report: https://oss-fuzz.com/testcase?key=6121765925289984 Project: boringssl Fuzzer: libFuzzerboringsslclient Fuzz target binary: client Job Type: libfuzzerubsanboringssl Platform Id: linux Crash Type: Incorrect-function-pointer-type...

boringssl: Incorrect-function-pointer-type in bssl::ssl_negotiate_alpn

Project: https://boringssl.googlesource.com/boringssl Detailed report: https://oss-fuzz.com/testcase?key=6088352019251200 Project: boringssl Fuzzer: libFuzzerboringsslserver Fuzz target binary: server Job Type: libfuzzerubsanboringssl Platform Id: linux Crash Type: Incorrect-function-pointer-type...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...

gdal: Incorrect-function-pointer-type in OGRCurve::CastToLineString

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5600546717171712 Project: gdal Fuzzer: libFuzzergdalogrfuzzer Fuzz target binary: ogrfuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Cras...

Citrix Provisioning Services 7.x < 7.12 Multiple Vulnerabilities (CTX219580)

The version of Citrix Provisioning Services running on the remote Windows host is either 7.x prior to 7.12 or 7.6 LTSR prior to 7.6.4 LTSR. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to an overflow condition caused by improper...

CVE-2016-9679

Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer...

CVE-2016-9679

Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer...

CVE-2016-9679

Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer...

Reverse Safety series: Use After Free vulnerability analysis-vulnerability warning-the black bar safety net

One, Foreword Thinking the next step is to write a use after free small summary, just happened to be the nearest Lake Gordon Cup 2016 the one.---- game Use the use after free can be out. This title is their first in more formal competitions, make pwn title, do this question of time spent a lot, t...

Oracle IOT IX SDK libvs_pdf XRef Index Code Execution Vulnerability

Talos Vulnerability Report TALOS-2016-0086 Oracle IOT IX SDK libvspdf XRef Index Code Execution Vulnerability April 19, 2016 CVE Number CVE-2016-3455 DESCRIPTION A vulnerability in PDF parser of the IX SDK exists that allows an out of bounds heap memory overwrite potentially leading to remote cod...

Fedora 23 : glibc-2.22-6.fc23 (2015-7174c4d68d)

This update re-adds large file support to the openat function, removes support for the LDPOINTERGUARD environment variable which could be used to weaken security protections in ATSECURE/SUID binaries, and adds function pointer obfuscation to the TLS destructor list. Note that Tenable Network...

Internet Bug Bounty: Type confusion in partial.setstate, partial_repr, partial_call leads to memory corruption, reliable control flow hijack

See my official writeups here: http://bugs.python.org/issue25944 http://bugs.python.org/issue25945 The maintainers merged these bug reports. In one case, the type confusion leads to a reliable control of the instruction pointer as calling repr on a corrupted partial calls a function pointer that ...