869 matches found
Weggli_rules_SSTIC2023
这里是一份精心整理的 weggli 查询列表 你可以逐一阅读和使用它们，也可以批量运行： 用法： root@kitploit: $ bash dangerousfunctions.qry code.c $ bash mallocoverflow.qry -e cc sourcedir/ 共有三个类别： 1. 危险函数：例如 strcpy、system 等.. 2. 栈：尝试检测栈上的拷贝，以及其他内容.. 3. malloc：查找 malloc 函数中的溢出 它们都是自动文档化的，你可以直接阅读它们。...
SSH-Remote-Code-Execution
SSH リモートコード実行 SSH ゼロデイ | ClumsyLulz & Taylor Christian Newsome 作 概要 このリポジトリには、入力パラメータを受け取り、SSH プロトコルでサーバーに送信するパケットを生成する C プログラムが含まれています。このプログラムは、データを保持するバッファを割り当て、それをファイルに書き込み、system 関数を使用して指定されたホストとポートへの SSH 接続を開始するコマンドライン文字列を構築します。 特定された問題 現在の実装には、いくつかのセキュリティおよび安定性の問題が存在します： 1. バッファオーバーフロー :...
heap-viewer
HeapViewer An IDA Pro plugin to examine the heap, focused on exploit development. Currently supports the glibc malloc implementation ptmalloc2. 3rd place winner of the 2018 Hex-Rays Plugin Contest Requirements IDA Pro = 7.0 Tested on glibc 2.23 = 2.26 GraphView for linked lists bins/tcache Struct...
one-multiply-too-many-cve-2026-70638-llama-cpp-android-jni-integer-overflow
CVE-2026-70638 - Estouro de Inteiro no JNI LLaMA-Android do llama.cpp PoC complementar para o artigo da Hunt-Benito "Uma Multiplicação a Mais: CVE-2026-70638 — Estouro de Inteiro na Alocação de Heap do JNI Android do llama.cpp" →...
CVE-2026-18370 Heap-based buffer overflow in entr
entr is vulnerable to Heap-based buffer overflow in runutility function. The function allocates a fixed-size heap buffer using mallocARGMAX and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy, which returns the total length of the...
CVE-2026-18370
entr is vulnerable to Heap-based buffer overflow in runutility function. The function allocates a fixed-size heap buffer using mallocARGMAX and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy, which returns the total length of the...
UBUNTU-CVE-2026-43627
llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llamabatchinit function where unchecked multiplications in malloc calls can wrap past INT32MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causin...
EUVD-2026-54096
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...
CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...
PYSEC-2026-3151 Integer overflow in TFLite array creation
Impact An attacker can craft a TFLite model that would cause an integer overflow in TfLiteIntArrayCreate: cc TfLiteIntArray TfLiteIntArrayCreateint size int allocsize = TfLiteIntArrayGetSizeInBytessize; // ... TfLiteIntArray ret = TfLiteIntArraymallocallocsize; // ... The...
CVE-2026-7828
UltraVNC repeater up to version 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, win_log() allocates memory with malloc(sizeof(struct LIST) + strlen(line)); if strlen(line) is large, the size overflows to a value smaller than sizeof(struct ...
CVE-2026-7828 UltraVNC repeater integer overflow in win_log malloc leading to heap overflow
UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the winlog function allocates list nodes via mallocsizeofstruct LIST + strlenline, where line is derived from HTTP request URIs. If strlenline is sufficiently large,...
CVE-2026-49840
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, eslrecvevent parses Content-Length with atol and passes the result straight to malloclen ...
UBUNTU-CVE-2026-47328
Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmallocd, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata an...
CVE-2026-48065 pam_usb: Unchecked integer multiplication before xmalloc() in conf.c allows heap-based buffer overflow on 32-bit targets
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/conf.c allocates heap memory proportional to ndevices, a count derived from libxml2 XPath evaluation of the config file, without first enforcing an upper bound. On 32-bit targets armv7l, i686 --...
Astra Linux – Vulnerability in ffmpeg5
FFmpeg v.n6.1-3-g466799d4f5 allows for memory consumption when using the colorcorrect filter, specifically in the avmalloc function located at line 105:9 of the libavutil/mem.c file...
Astra Linux – Vulnerability in curl
There is a vulnerability in curl v7.88.0 where resource allocation without limits or throttling exists. This vulnerability stems from the “chained” HTTP compression algorithms. This means that a server’s response can be compressed multiple times, possibly using different algorithms. The number of...
Astra Linux – Vulnerability in htmldoc
There is a vulnerability in htmldoc 1.9.16. In the imageloadjpeg function, when image.cxx calls malloc, ‘img-width’ and ‘img-height’ are too large to prevent an integer overflow. As a result, the malloc function may return a heap block smaller than expected, causing a buffer overflow/Address...