CVE-2018-6639

An out-of-bounds write Remote Code Execution issue was discovered in Design Science MathType 6.9c. A size used by memmove is read from the input file. This is fixed in 6.9d...

Remote code execution

An out-of-bounds write Remote Code Execution issue was discovered in Design Science MathType 6.9c. A size used by memmove is read from the input file. This is fixed in 6.9d...

Microsoft Windows Uniscribe Remote Code Execution Vulnerability(CVE-2017-0283)

We have encountered a crash in the Windows Uniscribe user-mode library, in the memmove function called by USP10!MergeLigRecords, while trying to display text using a corrupted font file: --- 4e0.6dc: Access violation - code c0000005 first chance First chance exceptions are reported before any...

MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rubysmb' require 'rubysmb/smb1/packet' class MetasploitModule 'MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption', 'Description' = %q This module is...

Microsoft Windows MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption Exploit

This Metasploit module is a port of the Equation Group ETERNALBLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers. There is a buffer overflow memmove operation in Srv!SrvOs2FeaToNt. The size is calculated in Srv!SrvOs2FeaListSizeToNt, with mathematical error where a DWORD is...

WebKit HTMLFormElement Negative-Size Memmove

WebKit: Negative-size memmove in HTMLFormElement CVE-2017-2459 There is a negative-size memmove security vulnerability in WebKit. The vulnerability was confirmed on a nightly build of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. PoC Note: It might take a couple of refresh...

Apple WebKit - Negative-Size memmove in HTMLFormElement Exploit

Exploit for multiple platform in category dos / poc function go var iframe = document.getElementById"iframe"; var iframeWindow = window0; var toInsert = div; var iframeBody = iframeWindow.document.body; iframeBody.beforedocument.body; iframe.aftertoInsert; aaaaaaaa !--...

Apple WebKit - Negative-Size memmove in HTMLFormElement

Apple WebKit - Negative-Size memmove in HTMLFormElement function go var iframe = document.getElementById"iframe"; var iframeWindow = window0; var toInsert = div; var iframeBody = iframeWindow.document.body; iframeBody.beforedocument.body; iframe.aftertoInsert; aaaaaaaa !--...

Apple WebKit - Negative-Size memmove in HTMLFormElement

function go var iframe = document.getElementById"iframe"; var iframeWindow = window0; var toInsert = div; var iframeBody = iframeWindow.document.body; iframeBody.beforedocument.body; iframe.aftertoInsert; aaaaaaaa !-- ================================================================= Preliminary...

GLSA-201702-15 : OCaml: Buffer overflow and information disclosure

The remote host is affected by the vulnerability described in GLSA-201702-15 OCaml: Buffer overflow and information disclosure It was discovered that OCaml was vulnerable to a runtime bug that, on 64-bit platforms, causes size arguments to internal memmove calls to be sign-extended from 32- to...

OCaml: Buffer overflow and information disclosure

Background OCaml is a high-level, strongly-typed, functional, and object-oriented programming language from the ML family of languages. Description It was discovered that OCaml was vulnerable to a runtime bug that, on 64-bit platforms, causes size arguments to internal memmove calls to be...

[SECURITY] [DLA 466-1] ocaml security update

Package : ocaml Version : 3.12.1-4+deb7u1 CVE ID : CVE-2015-8869 OCaml versions 4.02.3 and earlier have a runtime bug that, on 64-bit platforms, causes sizes arguments to an internal memmove call to be sign-extended from 32 to 64-bits before being passed to the memmove function. This leads...

OSEC-2016-01 Buffer overflow and information leak in OCaml < 4.03.0

Bug description OCaml versions 4.02.3 and earlier have a runtime bug that, on 64-bit platforms, causes sizes arguments to an internal memmove call to be sign-extended from 32 to 64-bits before being passed to the memmove function. This leads arguments between 2GiB and 4GiB to be interpreted as...

Taming the wild copy: Parallel Thread Corruption

Posted by Chris Evans, Winner of the occasional race Back in 2002, a very interesting vulnerability was found and fixed in the Apache web server. Relating to a bug in chunked encoding handing, the vulnerability caused a memcpy call with a negative length with the destination on the stack. Of...

Adobe Reader 10.1.4 JP2KLib&CoolType Crash PoC

No description provided by source. Title : Adobe Reader 10.1.4 JP2KLib&CoolType WriteAV Vulnerability Version : 10.1.4.38 Date : 2012-11-20 Vendor : http://www.adobe.com/ Impact : Med/High Contact : coolkaveh at rocketmail.com Twitter : @coolkaveh tested : XP SP3 ENG Author : coolkaveh...

eXtremail <= 2.1.1 memmove() Remote Denial of Service Exploit

No description provided by source. !/usr/bin/perl extremail-v3.pl Copyright c 2006 by [email protected] eXtremail =2.1.1 remote root POC x86-lnx by mu-b - Fri Oct 06 2006 Tested on: eXtremail 2.1.1 lnx eXtremail 2.1.0 lnx - Private Source Code -DO NOT DISTRIBUTE - http://www.digit-labs.org/ --...

Nvidia Display Driver Service (Nsvr) - Local Buffer Overflow

Nvidia Display Driver Service Nsvr - Local Buffer Overflow / NVidia Display Driver Service Nsvr Exploit - Christmas 2012 - Bypass DEP + ASLR + /GS + CoE ============================================================= @peterwintrsmith Initial release 25/12/12 Update 25/12/12 - Target for 30 Aug 2012...

Researcher Who Found Nvidia Bug Confirms Security Update Clears Up Driver Zero Day

Nvidia has released a new driver for its graphics cards that includes a security update for a zero-day vulnerability in the Nvidia Display Driver Service that came to light on Christmas day. UK researcher Peter Winter-Smith posted vulnerability details and an exploit to Pastebin describing a stac...

Adobe Reader 10.1.4 - JP2KLibCoolType Crash (PoC)

Adobe Reader 10.1.4 - JP2KLibCoolType Crash PoC Title : Adobe Reader 10.1.4 JP2KLib&CoolType WriteAV Vulnerability Version : 10.1.4.38 Date : 2012-11-20 Vendor : http://www.adobe.com/ Impact : Med/High Contact : coolkaveh at rocketmail.com Twitter : @coolkaveh tested : XP SP3 ENG Author : coolkav...

Adobe Reader 10.1.4 - JP2KLib&CoolType Crash (PoC)

Title : Adobe Reader 10.1.4 JP2KLib&CoolType WriteAV Vulnerability Version : 10.1.4.38 Date : 2012-11-20 Vendor : http://www.adobe.com/ Impact : Med/High Contact : coolkaveh at rocketmail.com Twitter : @coolkaveh tested : XP SP3 ENG Author : coolkaveh...