UBUNTU-CVE-2014-6040

GNU C Library aka glibc before 2.20 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via a multibyte character value of "0xffff" to the iconv function when converting 1 IBM933, 2 IBM935, 3 IBM937, 4 IBM939, or 5 IBM1364 encoded data to UTF-8...

glibc: off-by-one error leading to a heap-based buffer overflow flaw in __gconv_translit_find()

An off-by-one heap-based buffer overflow flaw was found in glibc's internal gconvtranslitfind function. An attacker able to make an application call the iconvopen function with a specially crafted argument could possibly use this flaw to execute arbitrary code with the privileges of that...

Debian DSA-3012-1 : eglibc - security update

Tavis Ormandy discovered a heap-based buffer overflow in the transliteration module loading code in eglibc, Debian's version of the GNU C Library. As a result, an attacker who can supply a crafted destination character set argument to iconv-related character conversation functions could achieve...

CVE-2014-5384

The VIQR module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service out-of-bounds array access via a crafted argument to the iconvopen function. NOTE: this issue was SPLIT from CVE-2014-3951 per ADT2 due to different...

CVE-2014-3951

The HZ module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service NULL pointer dereference via a crafted argument to the iconvopen function. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types...

Null pointer dereference

The HZ module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service NULL pointer dereference via a crafted argument to the iconvopen function. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types...

CVE-2014-3951

CVE-2014-3951 and CVE-2014-5384 describe issues in the iconv implementation on FreeBSD 10.0 before p6 and NetBSD, split per ADT2 by vulnerability type. The HZ module (CVE-2014-3951) can trigger a NULL pointer dereference in iconv_open, causing denial of service; the VIQR module (CVE-2014-5384) ca...

CVE-2014-5384

The CVE-2014-5384 entry concerns the VIQR module in the iconv implementation of FreeBSD 10.0 prior to p6 and NetBSD. The vulnerability is an out-of-bounds array access in the VIQR module of iconv_open, allowing context-dependent attackers to cause a denial of service. Affected environment is Free...

SuSE 11.3 Security Update : glibc (SAT Patch Number 9587)

This glibc update contains one security and two non security fixes : - directory traversal in LC locale handling. CVE-2014-0475. bnc887022 - nscd gets activated upon upgrade. bnc882028 - iconv command inserts a extra control code '0F'. bnc886416 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

利用骑士cms的一次纠结的渗透测试过程(两个潜在而被忽略的漏洞分析)

简要描述： 今天下载了骑士cms的最新版本，由于好久以前一个哥们发了一个后台拿shell的漏洞，还有别人发的一个sql注入的漏洞，一个有意思的渗透测试过程就从这两个地方开始了，成功的拿下了某大型人才网站的服务器，过程算比较艰辛吧，由于附带了对其实cms的漏洞重新分析，并且加入了自己新的利用方法，所以这里提交到了通用漏洞 详细说明： 第一步 我们分析一个老的sql注入问题： 文件job/plus/ajaxcommon.php:lines:88-100 if empty$GET'query' exit; $gbkquery=trim$GET'query'; if...

FreeBSD Security Advisory FreeBSD-SA-14:15.iconv

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:15.iconv Security Advisory The FreeBSD Project Topic: iconv3 NULL pointer dereference and out-of-bounds array access Category: core Module: libc/iconv...

FreeBSD iconv security vulnerabilities

NULL pointer dereference, out-of-bound array access...

FreeBSD-SA-14:15.iconv

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:15.iconv Security Advisory The FreeBSD Project Topic: iconv3 NULL pointer dereference and out-of-bounds array access Category: core Module: libc/iconv...

74CMS Sql注入漏洞一枚2

简要描述： 过滤不严。 详细说明： 在plus/ajaxuser.php中 elseif$act =='checkusname' requireonceQISHIROOTPATH.'include/funuser.php'; $usname=trim$POST'usname'; if strcasecmpQISHIDBCHARSET,"utf8"!=0 $usname=iconv"utf-8",QISHIDBCHARSET,$usname; $user=getuserinusername$usname; empty$user?exit"true":exit"false"; 也是iconv...

SuSE 11.2 Security Update : PHP5 (SAT Patch Number 6777)

This update fixes CVE-2011-1398 / CVE-2011-4388 header injection via CR. This update also changes the default configuration to use FilesMatch with 'SetHandler' rather than 'AddHandler' to protect weakly written web applications from content confusion. Since this is a hardening measure, no CVE was...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 8264)

This update changes the default configuration to use FilesMatch with 'SetHandler' rather than 'AddHandler' to protect weakly written web applications from content confusion. Since this is a hardening measure, no CVE was assigned. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

Scientific Linux Security Update : glibc on SL5.x i386/x86_64 (20120718)

The glibc packages provide the standard C and standard math libraries used by multiple programs on the system. Without these libraries, the Linux system cannot function properly. It was discovered that the formatted printing functionality in glibc did not properly restrict the use of alloca. This...

Moderate: Red Hat Security Advisory: glibc security and bug fix update

Updated glibc packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

glibc security and bug fix update

2.5-81.el58.4 - Fix iconv segfault if the invalid multibyte character 0xffff is input when converting from IBM930 837896 2.5-81.el58.3 - Fix unbound alloca in vfprintf 833720...

74CMS talent system v3. 2 injection & full version pass rounded out the background-bug warning-the black bar safety net

Because a station with this system next to the station is also no start so went down the parts of the source code to read Set of procedures filter is still relatively full, but all versions are GBK encoding is his flawed but basically the string into the library when the author used the iconv to...