Kernel doesn't clear DF for signal handlers

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag DF from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signa...

CVE-2008-2106: Improper Input Validation

Call of Duty 4 CoD4 1.5 and earlier allows remote authenticated users to cause a denial of service crash via a type 7 stats packet, which triggers a memcpy with a negative value...

游戏使命召唤畸形stats命令拒绝服务漏洞

BUGTRAQ ID: 29026 使命召唤（Call of Duty）是Infinity Ward开发的非常流行的第一人称扮演游戏。 使命召唤在处理畸形格式的请求数据时存在漏洞，远程攻击者可能利用此漏洞导致服务器不可用。 使命召唤4引入了一类被称为stats的无连接命令，玩家加入远程游戏后就会顺序发送0到6类型的上述命令。服务器还接收额外的7类型stats命令，如果客户端使用了这个7类型命令的话，远程服务器就会由于负数大小值的memcpy而崩溃。 成功利用这个漏洞要求攻击者知道受保护服务器的口令，此外如果服务器要求的话还需要拥有有效的cdkey。 Activision Call of...

DEBIAN-CVE-2008-1367

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag DF from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signa...

CVE-2008-1367

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag DF from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signa...

CVE-2008-1367

CVE-2008-1367 corresponds to a Linux kernel issue where gcc 4.3.x may not emit a cld instruction while compiling string manipulation code (e.g., memcpy/memmove), preventing the direction flag (DF) from being reset and potentially causing memory copy in the wrong direction during signal handling. ...

CVE-2008-1367: Undefined Security Weakness

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag DF from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signa...

Multiple vulnerabilities in WinCom LPD Total 3.0.2.623

Luigi Auriemma Application: WinCom LPD Total - Line Printer Daemon http://clientsoftware.com.au/lpd.html Versions: = 3.0.2.623 Platforms: Windows Bugs: A buffer-overflow in control filename B remote administration bypassing C integer memcpy crash in remote administration D buffer-overflow in remo...

ASA-2007-016: Remote crash vulnerability in Skinny channel driver

Asterisk Project Security Advisory - ASA-2007-016 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | Remote crash vulnerability in Skinny channel | | | driver |...

CVE-2007-3764

The Skinny channel driver chanskinny in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service crash via a certain data length value...

CVE-2007-3764

The Skinny channel driver chanskinny in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service crash via a certain data length value...

CVE-2007-3764: Undefined Security Weakness

The Skinny channel driver chanskinny in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service crash via a certain data length value...

Mandrake Linux Security Advisory : xine-lib (MDKSA-2007:062)

The DSVideoDecoderOpen function in DirectShow/DSVideoDecoder.c in xine-lib does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code. Updated packages have been patched to address this issue...

[Full-disclosure] MPlayer DMO buffer overflow

There's an exploitable buffer overflow in the current version of MPlayer v1.0rc1 which can be exploited with a maliciously crafted video file. It's hidden in the function DMOVideoDecoder in the file loader/dmo/DMOVideoDecoder.c. The variable format-biSize gets its value directly from the video...

Madwifi 0.9.2.1 - WPA/RSN IE Remote Kernel Buffer Overflow

/ ---- madwifi WPA/RSN IE remote kernel buffer overflow ------ expoit code by: sgrakkyu antifork.org -- 10/1/2007 CVE: 2006-6332 Laurent BUTTI, Jerome RAZNIEWSKI, Julien TINNES for wpa .... memcpybuf, se-sewpaie, se-sewpaie1 + 2 .... .... the function re-uses args in the stack before returning so...

security flaw

Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different...

Cyrus IMAPD 2.3.2 - pop3d Remote Buffer Overflow (2)

Cyrus IMAPD 2.3.2 - pop3d Remote Buffer Overflow 2 !/usr/bin/ruby cyrus-imapd pop3d exploit by bannedit 05/23/2006 This exploit takes advantage of a stack based overflow. Once the stack corruption has occured it is possible to overwrite a pointer which is later used for a memcpy this gives us a...

Cyrus IMAPD 2.3.2 (pop3d) Remote Buffer Overflow Exploit (2)

Exploit for multiple platform in category remote exploits ============================================================ Cyrus IMAPD 2.3.2 pop3d Remote Buffer Overflow Exploit 2 ============================================================ !/usr/bin/ruby cyrus-imapd pop3d exploit by bannedit...

Cyrus IMAPD 2.3.2 (pop3d) Remote Buffer Overflow Exploit (2)

No description provided by source. !/usr/bin/ruby cyrus-imapd pop3d exploit by bannedit 05/23/2006 This exploit takes advantage of a stack based overflow. Once the stack corruption has occured it is possible to overwrite a pointer which is later used for a memcpy this gives us a write anything...

Cyrus IMAPD 2.3.2 - 'pop3d' Remote Buffer Overflow (2)

!/usr/bin/ruby cyrus-imapd pop3d exploit by bannedit 05/23/2006 This exploit takes advantage of a stack based overflow. Once the stack corruption has occured it is possible to overwrite a pointer which is later used for a memcpy this gives us a write anything anywhere condition similar to a forma...