jansson -- local denial of service vulnerabilities

QuickFuzz reports: A crash caused by stack exhaustion parsing a JSON was found...

FreeBSD-SA-16:15.sysarch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-16:15.sysarch REVISED Security Advisory The FreeBSD Project Topic: Incorrect argument validation in sysarch2 Category: core Module: kernel Announced: 2016-10-25...

CVE-2015-7813

Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls, which allows local guests to cause a denial of service via a sequence of 1 HYPERVISORphysdevop hypercalls, which are not properly handled in the dophysdevop function in...

PT-2015-7685

Name of the Vulnerable Software and Affected Versions Xen versions 3.4.x through 4.6.x Description The issue arises from the incorrect calculation of the balloon size by the 1 libxl set memory target function in tools/libxl/libxl.c and 2 libxl build post function in tools/libxl/libxl dom.c when...

Microsoft Windows - NtCreateLowBoxToken Handle Capture Local Denial of Service / Privilege Escalation (MS15-111)

Source: https://code.google.com/p/google-security-research/issues/detail?id=483 Windows: NtCreateLowBoxToken Handle Capture Local DoS/Elevation of Privilege Platform: Windows 8.1 Update, Windows 10, Windows Server 2012 Class: Local Dos/Elevation of Privilege Summary: The NtCreateLowBoxToken API...

FreshFTP 5.52 - .qfl Crash (PoC)

FreshFTP 5.52 - .qfl Crash PoC Exploit Title: FreshFTP .QFL Local DOSWhile Parsing. Date: 9/15/2015 Exploit Author: UnN0n Software Vendor : http://www.freshwebmaster.com/ Software Link: http://www.freshwebmaster.com/download.html Version: 5.52 Tested on: Windows 7 x8632 BIT Steps to Produce the...

FreshFTP 5.52 - '.qfl' Crash (PoC)

Exploit Title: FreshFTP .QFL Local DOSWhile Parsing. Date: 9/15/2015 Exploit Author: UnN0n Software Vendor : http://www.freshwebmaster.com/ Software Link: http://www.freshwebmaster.com/download.html Version: 5.52 Tested on: Windows 7 x8632 BIT Steps to Produce the Crash: 1- Goto Directory in whic...

FreeBSD : tarsnap -- buffer overflow and local DoS (2fe40238-480f-11e5-adde-14dae9d210b8)

Colin Percival reports : 1. SECURITY FIX: When constructing paths of objects being archived, a buffer could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte paths. Theoretically this could be exploited by an unprivileged user whose files are being archived; I do not believe it i...

CVE-2015-3246: Time-of-check Time-of-use (TOCTOU) Race Condition

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service inconsistent file state by causing an error during the modification. NOTE: this issue can be combined wi...

PT-2015-6122

Name of the Vulnerable Software and Affected Versions libuser versions prior to 0.56.13-8 libuser version 0.60 prior to 0.60-7 Description The issue allows local users to cause a denial of service by causing an error during the modification of /etc/passwd, resulting in an inconsistent file state...

CVE-2015-4103

Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service host interrupt handling confusion via vectors related to qemu and accessing spanning multiple fields...

PT-2016-3583

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x Description The issue allows local users to cause a denial of service, specifically capability stripping, via a failed invocation of a system call. This can be demonstrated by using the chown command to remove a...

CVE-2015-0245

D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service activation failure error returned by leveraging a race condition involving sending an...

PT-2015-5224

Name of the Vulnerable Software and Affected Versions grep versions 2.19 through 2.21 Description The issue allows local users to cause a denial of service, resulting in an out-of-bounds heap read and crash, via crafted input when using the -F option. This is due to a problem in the bmexec trans...

CVE-2014-0998

Integer signedness error in the vt console driver formerly Newcons in FreeBSD 9.3 before p10 and 10.1 before p6 allows local users to cause a denial of service crash and possibly gain privileges via a negative value in a VTWAITACTIVE ioctl call, which triggers an array index error and out-of-boun...

CVE-2014-8608: Undefined Security Weakness

The K7Sentry.sys kernel mode driver aka K7AV Sentry Device Driver before 12.8.0.119, as used in multiple K7 Computing products, allows local users to cause a denial of service NULL pointer dereference as demonstrated by a filename containing "crashme$$"...

PT-2014-3141

Name of the Vulnerable Software and Affected Versions fedup version 0.9.0 in Fedora versions 19, 20, and 21 Description The issue allows local users to cause a denial of service, specifically the prevention of system updates, by exploiting the use of a temporary directory with a static name for t...

OpenBSD <= 5.5 Local Kernel Panic

OpenBSD = 5.5 All architectures is prone to a local DoS condition by triggering a kernel panic through a malformed ELF executable. A patch has been released to address this issue. See "013 Reliability Fix" at: http://www.openbsd.org/errata55.html013kernexec More details and PoC code:...

CVE-2014-3636: Undefined Security Weakness

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to 1 cause a denial of service prevention of new connections and connection drop by queuing the maximum number of file descriptors or 2 cause a denial of service disconnect via multiple messages that combine to have...

CVE-2014-3637

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor...