CVE-2019-20021

A heap-based buffer over-read was discovered in canUnpack in pmach.cpp in UPX 3.95 via a crafted Mach-O file...

CVE-2019-20021

A heap-based buffer over-read was discovered in canUnpack in pmach.cpp in UPX 3.95 via a crafted Mach-O file...

CVE-2019-20021

CVE-2019-20021 affects UPX, where UPX 3.95 contains a heap-based buffer over-read in canUnpack() within p_mach.cpp when processing crafted Mach-O files. OpenSUSE/Fedora advisories indicate the fix is in UPX 3.96, which patches this vulnerability (and related CVEs) by updating to 3.96. Practical i...

CVE-2019-20053: Improper Restriction of Operations within the Bounds of a Memory Buffer

An invalid memory address dereference was discovered in the canUnpack function in pmach.cpp in UPX 3.95 via a crafted Mach-O file...

PT-2019-16068 · Upx Team +3 · Upx +2

Name of the Vulnerable Software and Affected Versions: UPX version 3.95 ALT Linux affected versions not specified Description: An issue was found in the canUnpack function in p mach.cpp, which can be triggered by a crafted Mach-O file, leading to an invalid memory address dereference...

PT-2019-16056 · Upx +2 · Upx +2

Name of the Vulnerable Software and Affected Versions: UPX version 3.95 Description: A heap-based buffer over-read issue was found in the canUnpack function in p mach.cpp via a crafted Mach-O file. Recommendations: For UPX version 3.95, consider updating to a newer version that contains a fix for...

CVE-2019-20021: Out-of-bounds Read

A heap-based buffer over-read was discovered in canUnpack in pmach.cpp in UPX 3.95 via a crafted Mach-O file...

CVE-2019-18249

Reliable Controls MACH-ProWebCom/Sys, all versions prior to 2.15 Firmware versions prior to 8.26.4, may allow attacker to execute commands on behalf of the user when an authenticated user clicks on a malicious link...

CVE-2019-18249

Reliable Controls MACH-ProWebCom/Sys, all versions prior to 2.15 Firmware versions prior to 8.26.4, may allow attacker to execute commands on behalf of the user when an authenticated user clicks on a malicious link...

Design/Logic Flaw

Reliable Controls MACH-ProWebCom/Sys, all versions prior to 2.15 Firmware versions prior to 8.26.4, may allow attacker to execute commands on behalf of the user when an authenticated user clicks on a malicious link...

CVE-2019-18249

The CVE-2019-18249 issue affects Reliable Controls MACH-ProWebSys and MACH-ProWebCom/Sys (all versions prior to 2.15; firmware prior to 8.26.4). It is a Cross‑Site Scripting (CWE-79) vulnerability where an authenticated user clicking on a malicious link can cause the attacker to execute commands ...

CVE-2019-18249: Improper Neutralization of Input During Web Page Generation

Reliable Controls MACH-ProWebCom/Sys, all versions prior to 2.15 Firmware versions prior to 8.26.4, may allow attacker to execute commands on behalf of the user when an authenticated user clicks on a malicious link...

Reliable Controls MACH-ProWebCom/Sys Cross-Site Scripting Vulnerability

The Reliable Controls MACH-ProWebCom/Sys is a building controller from Canada's Reliable Controls that supports custom programming and has a built-in web server. A cross-site scripting vulnerability exists in Reliable Controls MACH-ProWebCom/Sys, which can be exploited by an attacker to execute...

Reliable Controls MACH-ProWebCom/Sys

1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION: Exploitable remotely Vendor: Reliable Controls Equipment: MACH-ProWebCom/Sys Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute commands on behalf of the affected user...

EulerOS 2.0 SP5 : binutils (EulerOS-SA-2019-1887)

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A NULL pointer dereference aka SEGV on unknown address 0x000000000000 was discovered in workstuffcopytofrom in cplus-dem.c in GNU libiberty, a...

In-the-wild iOS Exploit Chain 3

Posted by Ian Beer, Project Zero TL;DR This chain targeted iOS 11-11.4.1, spanning almost 10 months. This is the first chain we observed which had a separate sandbox escape exploit. The sandbox escape vulnerability was a severe security regression in libxpc, where refactoring lead to a bounds che...

iOS 12.1.3 - cfprefsd Memory Corruption Exploit

// c 2019 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes // Intended only for educational and defensive purposes only. // Use at your own risk. // iOS 12.1.3 - cfprefsd Memory Corruption Exploit include import include include include include include define AGENT 1 define...

macOS XNU - Copy-on-Write Behaviour Bypass via Partial-Page Truncation of File Exploit

/ XNU has various interfaces that permit creating copy-on-write copies of data between processes, including out-of-line message descriptors in mach messages. It is important that the copied memory is protected against later modifications by the source process; otherwise, the source process might ...

macOS < 10.14.3 / iOS < 12.1.3 - Arbitrary mach Port Name Deallocation in XPC Services due to Invalid mach Message Parsing in _xpc_serializer_unpack

/ xpcserializerunpack in libxpc parses mach messages which contain xpc messages. There are two reasons for an xpc mach message to contain descriptors: if the message body is large, then it's sent as a MACHMSGOOLDESCRIPTOR. Also if the message contains other port resources eg memory entry ports th...

macOS XNU - Copy-on-Write Behaviour Bypass via Partial-Page Truncation of File

/ XNU has various interfaces that permit creating copy-on-write copies of data between processes, including out-of-line message descriptors in mach messages. It is important that the copied memory is protected against later modifications by the source process; otherwise, the source process might ...