Apple macOS/iOS Kernel 10.12.3 (16D32) - SIOCGIFORDER Socket ioctl Off-by-One Memory Corruption

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1111 SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the ifnetorderedhead linked list of interfaces. SIOCSIFORDER clears the existing list and allows userspace to specify an array of interface indexes...

Network drives aren't mapped correctly from DFS namespace in Windows Server 2012 R2-based RDS server

Network drives aren't mapped correctly from DFS namespace in Windows Server 2012 R2-based RDS server This article describes an issue that occurs on a Windows Server 2012 R2-based computer that has the Remote Desktop Services RDS role installed. You can fix this issue by using the update in this...

Microsoft Internet Explorer s_DestroyMetaCallback Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how...

September 29, 2016 — KB3194496 (OS Builds 14393.222)

None None...

September 13, 2016 — KB3185614 (OS Build 10586.589)

None None...

[SECURITY] Fedora 24 Update: dietlibc-0.33-8.fc24

The diet libc is a libc that is optimized for small size. It can be used to create small statically linked binaries for Linux on alpha, arm, hppa, ia64, i386, mips, s390, sparc, sparc64, ppc and x8664...

Dashlane: Missing Access Control(IDOR) To Know LinkedAccounts

Hello Team, While Digging your Application I Came to Endpoint Where I Was Able to Check Whether Email is been Used in Multiple Account's or not , And Also Email's Are Getting Leaked . You have Feature to Enter Email To get Token : F105969 As you can see from the above Screenshot , I'm Logged in a...

Microsoft Internet Explorer s_DestroyLinkCallback Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how...

USN-2984-1 php5, php7.0 vulnerabilities

It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. CVE-2015-8865 Hans Jerry Illikainen...

DEBIAN-CVE-2016-2548

sound/core/timer.c in the Linux kernel before 4.4.1 retains certain linked lists after a close or stop action, which allows local users to cause a denial of service system crash via a crafted ioctl call, related to the 1 sndtimerclose and 2 sndtimerstop functions...

DEBIAN-CVE-2016-2545

The sndtimerinterrupt function in sound/core/timer.c in the Linux kernel before 4.4.1 does not properly maintain a certain linked list, which allows local users to cause a denial of service race condition and system crash via a crafted ioctl call...

UBUNTU-CVE-2016-2545

The sndtimerinterrupt function in sound/core/timer.c in the Linux kernel before 4.4.1 does not properly maintain a certain linked list, which allows local users to cause a denial of service race condition and system crash via a crafted ioctl call...

Repeated snapshot consolidation requests on VM by Snapshot Hunter

Article Applicability This article specifically applies to a situation where a VM was created using a third-party VDI, fast-provisioning application, or PowerCLI with the -LinkedClone parameter. Challenge Shortly after a backup or replication job runs, multiple Consolidate Snapshot operations are...

Updated mono packages fix security vulnerability

It was found that float-parsing code used in Mono before 4.2 is derived from code vulnerable to CVE-2009-0689. The issue concerns the 'freelist' array, which is a global array of 16 pointers to 'Bigint'. This array is part of a memory allocation and reuse system which attempts to reduce the numbe...

Analysis of the Linux heap overflow of fastbin-vulnerability warning-the black bar safety net

Some time ago to participate in the RCTF match, encountered a stack overflow topic shaxian it. The vulnerability itself is quite obvious, but due to a heap overflow is not familiar, have not been able to find the use of the method. After reading Fudan University six star clan it is, only know it...

Gentoo Security Advisory GLSA 201401-29

Gentoo Linux Local Security Checks GLSA 201401-29 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Gentoo Security Advisory GLSA 201401-28

Gentoo Linux Local Security Checks GLSA 201401-28 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

UBUNTU-CVE-2015-6831

Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving 1 ArrayObject, 2 SplObjectStorage, and 3 SplDoublyLinkedList, which are mishandled during unserialization...

PT-2015-3096 · Php +2 · Php +2

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 5.4.44 PHP versions 5.5.x prior to 5.5.28 PHP versions 5.6.x prior to 5.6.12 Description: The issue is related to multiple use-after-free vulnerabilities in the SPL library of the PHP interpreter, which can be exploited ...

Heap overflow unlink using the method-vulnerability warning-the black bar safety net

0x01 the first part of the First a brief introduction about the heap chunk structure We may be in malloc. c is found on the heap chunk structure of the code struct mallocchunk INTERNALSIZET prevsize; / Size of previous chunk if free. / INTERNALSIZET size; / Size in bytes, including overhead. /...