SSH-Remote-Code-Execution

SSH Remote Code Execution SSH Zero-Day | Hecho por ClumsyLulz y Taylor Christian Newsome Resumen Este repositorio contiene un programa en C que acepta parámetros de entrada y genera un paquete para enviarlo a un servidor mediante el protocolo SSH. El programa asigna un búfer para almacenar los...

how2heap

Educational Heap Exploitation This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases. You can run apt source libc6 to download the source code of the Libc you are using...

Weggli_rules_SSTIC2023

Aquí hay una lista curada de consultas de weggli Puedes leerlas y usarlas una por una, o lanzarlas por lotes: Uso: $ bash dangerousfunctions.qry code.c $ bash mallocoverflow.qry -e cc sourcedir/ Hay tres categorías: 1. funciones peligrosas: como strcpy, system, etc.. 2. stack: intenta detectar...

one-multiply-too-many-cve-2026-70638-llama-cpp-android-jni-integer-overflow

CVE-2026-70638 - Desbordamiento de enteros JNI de LLaMA-Android en llama.cpp PoC complementario para el artículo de Hunt-Benito "Una multiplicación de más: CVE-2026-70638 — Desbordamiento de enteros en la asignación de montón JNI de Android de llama.cpp" →...

CLEANSTART-2025-LU26051 Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution

Security vulnerability affects the exim package. Exim supports the use of multiple "-p" command line arguments which are malloc'ed and never free'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution...

SUSE CVE-2026-97920

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails printentries uses nentries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails overwrite...

CVE-2026-102808

PX4 Autopilot versions through 1.17.0 are vulnerable to a NULL pointer dereference within the sd_stress command. The root cause is the lack of validation for the -b byte count parameter before it is processed by malloc() and memset(). An attacker with shell access, which can be obtained via MAVLi...

CVE-2026-102808 PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sdstress command where the -b byte count parameter is parsed without validation before being passed to malloc and memset. Attackers with shell access, including through MAVLink, can supply invalid byte count...

CVE-2026-97920

The Linux kernel contains a vulnerability where the print_entries() function incorrectly handles memory allocation failures. When a histogram stats allocation fails, the variable n_entries is overwritten with -ENOMEM. Because tracing_map_destroy_sort_entries() treats this value as an unsigned int...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libtar (UTSA-2026-054042)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054042 advisory. An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc0 for a variable gnulongname, causing an...

PT-2026-95909

Name of the Vulnerable Software and Affected Versions Kamailio versions prior to 6.0.8 Description A heap-based buffer overflow can be triggered remotely within the CDP Diameter Receiver component. The issue resides in the shm malloc function located in the src/modules/cdp/receiver.c file. A...

Astra Linux – Vulnerability in klibc

A issue was discovered in klibc before version 2.0.9. Additions in the malloc function may lead to an integer overflow, followed by a heap buffer overflow...

Astra Linux – Vulnerability in htmldoc

There is a vulnerability in htmldoc 1.9.16. In the imageloadjpeg function, when image.cxx calls malloc, ‘img-width’ and ‘img-height’ are too large to prevent an integer overflow. As a result, the malloc function may return a heap block smaller than expected, causing a buffer overflow/Address...

Astra Linux – Vulnerability in ffmpeg5

FFmpeg v.n6.1-3-g466799d4f5 allows for memory consumption when using the colorcorrect filter, specifically in the avmalloc function located at line 105:9 of the libavutil/mem.c file...

Astra Linux – Vulnerability in ffmpeg, ffmpeg5

There is a NULL pointer dereference vulnerability in FFmpeg’s Firequalizer filter libavfilter/affirequalizer.c. This vulnerability arises due to a missing check on the return value of avmallocarray in the configinput function. An attacker could exploit this vulnerability by tricking a victim into...

Astra Linux – Vulnerability in curl

There is a vulnerability in curl v7.88.0 where resource allocation without limits or throttling exists. This vulnerability stems from the “chained” HTTP compression algorithms. This means that a server’s response can be compressed multiple times, possibly using different algorithms. The number of...

Astra Linux – Vulnerability in Redis

A heap overflow issue was discovered in Redis versions prior to 5.0.10, before 6.0.9, and before 6.2.0, when using a heap allocator other than jemalloc or glibc’s malloc function. This issue could lead to out-of-bound writing or the crash of the process. Essentially, this flaw does not affect the...

Astra Linux – Vulnerability in hiredis

In libhiredis.a under hiredis through version 0.14.0, async.c and dict.c allow a NULL pointer dereferencing because the return values of malloc are unchecked...

PT-2026-88233

In LimitRealloc of malloc limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-18370

entr is vulnerable to Heap-based buffer overflow in runutility function. The function allocates a fixed-size heap buffer using mallocARGMAX and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy, which returns the total length of the...