The vulnerability of the avcodec codec in the VideoLAN Media Player allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the avcodec codec in the VideoLAN Media Player media player arises from an operation that goes beyond buffer boundaries in dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure termination of the applicatio...

Internet Bug Bounty: PHP OpenSSL zif_openssl_seal() heap overflow (wild memcpy)

Description: A wild memcpy is discovered in the openssl package included in stable PHP release. During parsing a PEM certificate in opensslseal, an invalid key length is produced after parsing, eskl0 value is -1 after the call to EVPSealInit, subsequently causing a heap overflow via a wild memcpy...

CVE-2017-0340

An elevation of privilege vulnerability in the NVIDIA Libnvparser component due to a memcpy into a fixed sized buffer with a user-controlled size could lead to a memory corruption and possible remote code execution. This issue is rated as High. Product: Android. Version: N/A. Android ID:...

CVE-2017-0340

CVE-2017-0340 is an elevation of privilege in the NVIDIA Libnvparser component for Android, caused by a memcpy into a fixed-size buffer with user-controlled size that can lead to memory corruption and possible remote code execution. The entry is rated HIGH (CVSSv3 7.8, CVSSv2 9.3) and has no expl...

CVE-2017-0340

An elevation of privilege vulnerability in the NVIDIA Libnvparser component due to a memcpy into a fixed sized buffer with a user-controlled size could lead to a memory corruption and possible remote code execution. This issue is rated as High. Product: Android. Version: N/A. Android ID:...

VideoLAN VLC avcodec Denial of Service Vulnerability

VideoLAN VLC media player is a free, open source cross-platform multimedia player also a multimedia framework developed by the French organization VideoLAN. The product supports the playback of a variety of media files, CD-ROMs, etc., a variety of audio and video formats WMV, MP3, etc., etc...

CVE-2017-10699

avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy with a wrong size, leading to a denial of service application crash or possibly code execution...

CVE-2017-10699

avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy with a wrong size, leading to a denial of service application crash or possibly code execution...

CVE-2017-10699

avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy with a wrong size, leading to a denial of service application crash or possibly code execution...

CVE-2017-10699

CVE-2017-10699 affects VLC media player (v2.2.x) where avcodec 2.2.x can perform an out-of-bounds heap memory write by calling memcpy() with an incorrect size in VLC before 2.2.7, potentially crashing the application or enabling code execution. Public advisories and vendor patches indicate fixes ...

CVE-2017-10699

avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy with a wrong size, leading to a denial of service application crash or possibly code execution...

EulerOS 2.0 SP1 : icoutils (EulerOS-SA-2017-1089)

According to the versions of the icoutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple vulnerabilities were found in icoutils, in the wrestool program. An attacker could create a crafted executable that, when read by...

Apple iOS / macOS - NSKeyedArchiver Heap Corruption Due to Rounding Error in TIKeyboardLayout initWi

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1172 Using lldb inside a simple helloworld app for iOS we can see that there are over 600 classes which we could get deserialized for persistance for example. The TextInput...

gdal: Memcpy-param-overlap in KML::unregisterLayerIfMatchingThisNode

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5115360233652224 Project: gdal Fuzzer: libFuzzergdalogrfuzzer Fuzz target binary: ogrfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address:...

Safari Browser: Memory corruption in Array concat (CVE-2017-2464)

There is an out-of-bounds memcpy in Array.concat that can lead to memory corruption. In builtins/ArrayPrototype.js, the function concatSlowPath calls a native method @appendMemcpy with a parameter resultIndex that is handled unsafely by the method. It calls JSArray::appendMemcpy, which calculates...

LibSass: stack overflow #6 in libsass

Feeding //0i: to ./sassc -s triggers this stack overflow. ==11380==ERROR: AddressSanitizer: stack-overflow on address 0x7fff1665bfa8 pc 0x000000584802 bp 0x7fff1665c810 sp 0x7fff1665bfb0 T0 0 0x584801 in asanmemcpy /home/geeknik/sassc/bin/sassc+0x584801 1 0x87a353 in char const...

Quest Privilege Manager pmmasterd Buffer Overflow

This modules exploits a buffer overflow in the Quest Privilege Manager, a software used to integrate Active Directory with Linux and Unix systems. The vulnerability exists in the pmmasterd daemon, and can only triggered when the host has been configured as a policy server Privilege Manager for Un...

Broadcom: Multiple memory corruptions in "dhd_pno_process_anqpo_result" (CVE-2017-0572)

Detailed analysis of reference : the https://googleprojectzero.blogspot.tw/2017/04/over-air-exploiting-broadcoms-wi-fi4.html the first part https://googleprojectzero.blogspot.tw/2017/04/over-air-exploiting-broadcoms-wi-fi11.html Part II Broadcom produces the Wi-Fi HardMAC SoCs which are used to...

MacOS kernel memory disclosure due to lack of bounds checking in AppleIntelCapriController::getDisplayPipeCapability(CVE-2017-2489)

MacOS kernel memory disclosure due to lack of bounds checking in AppleIntelCapriController::getDisplayPipeCapability Selector 0x710 of IntelFBClientControl ends up in AppleIntelCapriController::getDisplayPipeCapability. This method takes a structure input and output buffer. It reads an attacker...

Important: Red Hat Security Advisory: icoutils security update

An update for icoutils is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...