Valve: Malformed NAV file leads to buffer overflow and code execution in Left4Dead2.exe

Summary In the parsing routines of NAV files which contain the navigation mesh used by the AI for survivor bots, zombies, and the AI director spawning system a buffer overflow exists which can be used to control the EIP register and takeover code execution. Proof-of-Concept 1. Download the attach...

[SECURITY] Fedora 30 Update: gnome-maps-3.32.1-2.fc30

GNOME Maps is a simple map application for the GNOME desktop...

Oracle Java Runtime Environment - Heap Corruption During TTF font Rendering in GlyphIterator

Oracle Java Runtime Environment - Heap Corruption During TTF font Rendering in GlyphIterator::setCurrGlyphID A heap corruption was observed in Oracle Java Runtime Environment version 8u202 latest at the time of this writing while fuzz-testing the processing of TrueType fonts. It manifests itself ...

GHSA-462W-V97R-4M45 Jinja2 sandbox escape via string formatting

In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape. The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the str.formatmap method could be used to escape the sandbox. This...

CVE-2019-7359

An exploitable heap overflow vulnerability in the AcCellMargin handling code in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018,...

CVE-2019-7360

CVE-2019-7360 describes an exploitable use-after-free in the DXF-parsing logic of Autodesk AutoCAD 2018 family (Advance Steel, AutoCAD, Civil 3D, etc.). The root cause is a memory-management flaw in the LinetypeTableRecord handling: when the file indicates a zero-length Elements field, an allocat...

PYSEC-2019-217

In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape...

PYSEC-2019-217

In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape...

DEBIAN-CVE-2019-10906

In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape...

UBUNTU-CVE-2019-10906

In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape...

Integer overflow

In Teeworlds 0.7.2, there is an integer overflow in CMap::Load in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled...

CVE-2019-10877

In Teeworlds 0.7.2, there is an integer overflow in CMap::Load in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled...

DEBIAN-CVE-2019-10877

In Teeworlds 0.7.2, there is an integer overflow in CMap::Load in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled...

UBUNTU-CVE-2019-10877

In Teeworlds 0.7.2, there is an integer overflow in CMap::Load in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled...

CDN Tuning for OTT - "Why Doesn't it Already do That?"

When you initially onboarded your OTT traffic to a CDN, you probably went with default settings. And to be honest, why wouldn't you? A standard media configuration is designed for the short http-based segment delivery at scale. It removes the bottleneck of your origin connectivity, taking you fro...

Linux kernel pointer dereference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the expanddownwards of the mm/mmap.c file in versions of Linux kernel prior to 4.20.14. An attacker can exploit this vulnerability t...

vBulletin 4.2.5 Member Map 1.1.2 Open Redirection

Exploit Title : vBulletin 4.2.5 Member Map 1.1.2 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/03/2019 Vendor Homepage : vbulletin.com dragonbyte-tech.com Software Information Link : dragonbyte-tech.com/store/member-map.229/ Software Affect...

Reko - A General Purpose Binary Decompiler

Reko Swedish: "decent, obliging" is a C project containing a decompiler for machine code binaries. This project is freely available under the GNU General Public License. The project consists of front ends, core decompiler engine, and back ends to help it achieve its goals. A command-line, a Windo...

CVE-2019-9075

An issue was discovered in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.32. It is a heap-based buffer overflow in bfdarchive64bitslurparmap in archive64.c...

The vulnerability of the map_write() function in “kernel/user_namespace.c” in the Linux operating system allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the mapwrite function in “kernel/usernamespace.c” in the Linux operating system is related to improper authorization. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...