PHP Socket connect() Stack Buffer Overflow

Hi there, This is a quick writeup about some fun with apache based on CVE-2011-1938 that was disclosed yesterday. While the first POC was literally just a trivial POC - the second one was written for self-educational purposes we leared quite a lot which is the most important thing and we hope it...

Microsoft Office Excel RealTimeData Record Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office Excel. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the methods used f...

DEBIAN-CVE-2010-4530

Signedness error in ccidserial.c in libccid in the USB Chip/Smart Card Interface Devices CCID driver, as used in pcscd in PCSC-Lite 1.5.3 and possibly other products, allows physically proximate attackers to execute arbitrary code via a smart card with a crafted serial number that causes a negati...

Oracle Java Runtime HeadspaceSoundbank.nGetName BANK Record Size Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Oracle Java Runtime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Avast! 5.0 aswFW.sys kernel driver IOCTL Memory Pool Corruption

Exploit for windows platform in category dos / poc ================================================================================= Avast! Internet Security 5.0 aswFW.sys kernel driver IOCTL Memory Pool Corruption =================================================================================...

Avast! Internet Security 5.0 aswFW.sys kernel driver IOCTL Memory Pool Corruption

No description provided by source. +-------------------------------------------------------------------------------------+ | Avast! Internet Security 5.0 'aswFW.sys' kernel driver IOCTL Memory Pool Corruption | +-------------------------------------------------------------------------------------...

VariCAD 2010-2.05 EN Local Buffer Overflow Vulnerability

Exploit for multiple platform in category local exploits ======================================================== VariCAD 2010-2.05 EN Local Buffer Overflow Vulnerability ======================================================== / Exploit Title: VariCAD 2010-2.05 EN Local buffer overflow : Date: 1...

Microsoft Office PowerPoint Viewer TextBytesAtom Record Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office PowerPoint Viewer. User interaction is required to exploit this vulnerability in that the target must open a malicious presentation. The specific flaw exists in the handling of...

Linux Kernel HFS子系统栈溢出漏洞

CVE ID: CVE-2009-4020 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的fs/hfs/dir.c文件中的hfsreaddir函数存在栈溢出漏洞，特制的多级文件系统（HFS）可以在 hfsbnoderead函数的memcpy调用过程中触发这个溢出。攻击者可以提供源缓冲区和长度，目标缓冲区是固定长度的本地变量，这个变量存储在了hfsbnoderead调用程序的栈帧中（hfsreaddir）。由于在试图读取文件系统上目录时都会执行 hfsreaddir函数，因此用户试图检查任何文件系统内容时都会调用这个函数。 Linux...

FreeBSD : apache -- apr_uri_parse IPv6 address handling vulnerability (762d1c6d-0722-11d9-b45d-000c41e2cdad)

The Apache Software Foundation Security Team discovered a programming error in the apr-util library function apruriparse. When parsing IPv6 literal addresses, it is possible that a length is incorrectly calculated to be negative, and this value is passed to memcpy. This may result in an exploitab...

Oracle RDBms 10.2.0.311.1.0.6 - TNS Listener (PoC)

Oracle RDBms 10.2.0.311.1.0.6 - TNS Listener PoC TNS Listener Oracle RDBMS exploit, cause trap in Listener process more precisely: in function memcpy called from ncrfintn function which is located in oranro11.dll Successfully working with Oracle RDBMS Win32 11.1.0.6.0 and Oracle RDBMS Win32...

Mandriva Update for xine-lib MDKSA-2007:057 (xine-lib)

Check for the Version of xine-lib OpenVAS Vulnerability Test Mandriva Update for xine-lib MDKSA-2007:057 xine-lib Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

wireshark: DoS (app crash or abort) in Bluetooth ACL dissector via a packet with an invalid length

The dissectbtacl function in packet-bthciacl.c in the Bluetooth ACL dissector in Wireshark 0.99.2 through 1.0.3 allows remote attackers to cause a denial of service application crash or abort via a packet with an invalid length, related to an erroneous tvbmemcpy call...

MPlayer Stack Buffer Overflow

!/usr/bin/perl MPlayer 1.0rc2 TwinVQ Stack Buffer Overflow PoC PoC by Amirreza Aminsalehi "sCORPINo" Proud To be an Abay scorpino x40 gmail x2e com Snoop Security Researching Committee www.snoop-security.com Originaly this bug discovered by Tobias Klein advisory @...

MPlayer 1.0rc2 - TwinVQ Stack Buffer Overflow (PoC)

!/usr/bin/perl MPlayer 1.0rc2 TwinVQ Stack Buffer Overflow PoC PoC by Amirreza Aminsalehi "sCORPINo" Proud To be an Abay scorpino x40 gmail x2e com Snoop Security Researching Committee www.snoop-security.com Originaly this bug discovered by Tobias Klein advisory @...

PSI Integer Overflow Denial Of Service

============================================= INTERNET SECURITY AUDITORS ALERT 2008-004 - Original release date: 12th December, 2008 - Last revised: 22nd December, 2008 - Discovered by: Jesus Olmos Gonzalez - Severity: 4/5 ============================================= I. VULNERABILITY...

IBM OS/400 BrSmRcvAndCheck()远程溢出漏洞

BUGTRAQ ID: 29660 IBM OS/400是IBM网络服务器上所运行的操作系统。 IBM OS/400在modem端口上执行诊断时，IBM OS/400中由BrSmIntWrap所调用的BrSmRcvAndCheck函数未经长度检查便执行了memcpy操作。如果远程攻击者提交了超长参数的话，就可能触发缓冲区溢出，导致初始程序加载（IPL）bootstrap进程终止。 IBM OS/400 V6R1M0 IBM OS/400 V5R4M5 IBM OS/400 V5R4M0 IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2008-2106

Call of Duty 4 CoD4 1.5 and earlier allows remote authenticated users to cause a denial of service crash via a type 7 stats packet, which triggers a memcpy with a negative value...

CVE-2008-2106

Call of Duty 4 CoD4 1.5 and earlier allows remote authenticated users to cause a denial of service crash via a type 7 stats packet, which triggers a memcpy with a negative value...

CVE-2008-2106

Summary: CVE-2008-2106 affects Call of Duty 4 (CoD4) v1.5 and earlier. The issue allows remote authenticated users to cause a denial of service (crash) by sending a type 7 stats packet that triggers a memcpy with a negative value. This is the concrete vulnerability described in the connected docu...