flow_divert-heap-overflow

flowdivert-heap-overflow flowdivert-heap-overflow 是针对 CVE-2016-1827 的概念验证漏洞利用，该漏洞已在 OS X El Capitan 10.11.5 和 iOS 9.3.2 中修复。 该漏洞是函数 flowdiverthandleappmapcreate 中针对用户空间提供的不可信长度进行的一系列未检查算术运算。利用该漏洞需要 root 权限。 此概念验证会在 OS X Yosemite 10.10.5 上触发内核恐慌。在 El Capitan 中，长度字段已从 64 位改为 32...

CVE-2026-89620

A flaw was found in the Linux kernel's HID Intel QuickSPI driver. A local attacker can exploit a heap buffer overflow by providing a specially crafted report through a hidraw SETREPORT/SETFEATURE ioctl. This allows the attacker to overflow a buffer with controlled length and content, potentially...

CVE-2026-55200

安全报告：CVE-2026-55200 📝 概述 CVE-2026-55200 是一个基于 堆 的严重内存溢出漏洞（动态内存损坏），影响版本至 1.11.1 的 libssh2 库。 它允许恶意 SSH 服务器攻击连接到它的脆弱客户端。 ⚡ 技术细节 漏洞类型： 内存溢出（ 基于堆的缓冲区溢出 ）。 主要影响： 远程代码执行 RCE 和拒绝服务 DoS。 攻击阶段： 发生在密码学身份验证之前 。 攻击向量： 恶意或被拦截的 SSH 服务器发送一个长度过长的数据包，溢出客户端分配的缓冲区。 🏗️ 供应链影响 该漏洞影响范围极广，因为 libssh2 被多种流行工具和语言使用： curl...

CVE-2026-89724

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct fwhtcframehdr...

CVE-2026-89620

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

CVE-2026-89436

In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc-sinf acpipccretrievebiosdata rejects SINF packages only when pcc-numsifr is strictly less than hkey-package.count, then unconditionally writes a trailing sentinel at...

CVE-2026-81013

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-81014

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in skstore and kekstore skstore and kekstore strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == '\n' length--;...

CVE-2026-81011

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

CVE-2026-80960

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media segnum against the cache device size segnum is read from the crc32c-only superblock, so whoever supplies the cache device on a table load CAPSYSADMIN controls it. It sizes cache-segments and is the...

heappy

🙂 Heappy：一个快乐的堆编辑器 Heappy 是一款基于 gdb/gef 的编辑器，可帮助你在漏洞利用开发过程中处理堆。 该项目应被视为一种教学工具，有助于理解堆在进程生命周期中的演化过程。它的创建是为了简化最常见堆利用技术的学习，并支持你解决与此主题相关的二进制利用 CTF。 主要特性 这是 Heappy 实现的功能： ✅ 获取堆快照并相互比较 ✅ 立即识别堆 bin 的类型和字段 ✅ 通过十进制、十六进制或字符串搜索和编辑堆值 ✅ 借助堆状态的全景视图轻松定位 ✅ 在注释列中记录关于某个单元格的备注 ✅ 享受浅色和深色模式 快速开始 以下说明将帮助你快速安装和运行 Heappy...

heappy

🙂 Heappy: a happy heap editor Heappy is an editor based on gdb/gef that helps you to handle the heap during your exploitation development. The project should be considered a didactic tool useful to understand the evolution of the heap during the process life cycle. It has been created to simplify...

CVE-2021-21017

CVE-2021-21017 又一个 Adobe Reader 字节顺序标记错误 : root@kitploit: IA32 plugin, ver. 2020.013.20074. char cdecl FUN2581894cchar baseurl,LPCSTR relurl ............................................................ ............................................................ if baseurl != char 0x0 && relurl !...

CVE-2021-3156

CVE-2021-3156 1.9.5p2 之前的 Sudo 包含一个 off-by-one 错误，可能导致堆缓冲区溢出，从而允许通过 sudoedit -s 和以单个反斜杠字符结尾的命令行参数将权限提升至 root。 致谢：安全公告由 Qualys 的 Baron Samedit 提供 如何检查你是否受影响。 sudo 项目 发布了一条命令，可用于测试你的 sudo 版本是否存在漏洞： root@kitploit: sudoedit -s '' perl -e 'print "A" x 65536' 如果你收到用法或错误消息，则说明 sudo...

shed

Shed - .NET 运行时检查器 Shed 是一款用于检查程序 .NET 运行时以提取有用信息的应用程序。它可用于检查恶意应用程序，以便在恶意软件运行时初步了解其中存储了哪些信息。 Shed 能够： 将 .NET Assembly 注入到远程进程中（包括托管和非托管进程） 提取托管堆中存储的所有对象 打印内存中存储的字符串 以 JSON 格式保存堆的快照，用于后期处理 转储所有加载到内存中的模块 下载 源代码 下载二进制文件 使用 Shed Shed 是一款命令行工具。要显示所有可用选项，请运行： shed.exe --help 检查正在运行的应用程序...

shed

Shed - .NET runtime inspector Shed is an application that allow to inspect the .NET runtime of a program in order to extract useful information. It can be used to inspect malicious applications in order to have a first general overview of which information are stored once that the malware is...

heaphopper

heaphopper HeapHopper is a bounded model checking framework for Heap-implementations. Overview Setup root@kitploit: sudo apt update && sudo apt install build-essential python3-dev virtualenvwrapper git clone https://github.com/angr/heaphopper.git && cd ./heaphopper mkvirtualenv -ppython3 heaphopp...

heaphopper

heaphopper HeapHopper 是一个用于堆实现的有界模型检测框架。 概述 安装 root@kitploit: sudo apt update && sudo apt install build-essential python3-dev virtualenvwrapper git clone https://github.com/angr/heaphopper.git && cd ./heaphopper mkvirtualenv -ppython3 heaphopper pip install -e . 所需系统包 root@kitploit: build-essenti...

CVE-2026-89743 misc: nsm: bound the device-reported response length

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsmsendrecvmsglocked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy backend...

EUVD-2026-76655

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsmsendrecvmsglocked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy backend...