shopify-scripts: Use after free vulnerability in mruby Array#to_h causing DOS possible RCE

This bug was found with jmlb337. Vulnerability The function toh will call the C function mrbarytoh. This will iterate through the elements of the array. If an element is not of type Array it will call attempt to call toary method of that object. If toary does not return an array, the function wil...

shopify-scripts: Memory disclosure in mruby String#lines method

This bug was found with jmlb337. Hey again, while reviewing mruby for vulnerabilities, I stumble onto a case that allow an attacker to leak heap content including pointer that can be used along another vulnerability to craft a complete exploit. Reproduction Step 1. Allocate a string with a few...

CVE-2016-7233

Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2013 SP1, and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory o...

CVE-2016-7210

atmfd.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a...

CVE-2016-7233

CVE-2016-7233 is an information-disclosure/out-of-bounds-read vulnerability in multiple Microsoft Office components (e.g., Word 2007, Office 2010 SP2, Word for Mac 2011, Excel for Mac 2011, Word Viewer, Office Web Apps 2010 SP2, SharePoint 2013 components, and Office Automation Services). A craft...

Microsoft Internet Explorer 11109 - MSHTML PROPERTYDESC::Handle­Style­Component­Property Out-of-Bounds Read (MS16-104)

Microsoft Internet Explorer 11109 - MSHTML PROPERTYDESC::Handle­Style­Component­Property Out-of-Bounds Read MS16-104 // This Po­C attempts to exploit a memory disclosure bug in Microsoft Internet // Explorer 11. On x64 systems, this should cause an access violation when // run with page-heap...

Microsoft WININET.dll - CHttp­Header­Parser::Parse­Status­Line Out-of-Bounds Read (MS16-104MS16-105)

Microsoft WININET.dll - CHttp­Header­Parser::Parse­Status­Line Out-of-Bounds Read MS16-104MS16-105 !-- Source: http://blog.skylined.nl/20161110001.html Synopsis A specially crafted HTTP response can cause the CHttp­Header­Parser::Parse­Status­Line method in WININET to read data beyond the end of ...

Microsoft Internet Explorer 11/10/9 - MSHTML 'PROPERTYDESC::Handle­Style­Component­Property' Out-of-Bounds Read (MS16-104)

// This Po­C attempts to exploit a memory disclosure bug in Microsoft Internet // Explorer 11. On x64 systems, this should cause an access violation when // run with page-heap enabled, as the code attempts to read a byte // immediately following a 4 byte memory block. // See...

VBScript 5.8.7600.163855.8.9600.16384 - RegExpComp::PnodeParse Out-of-Bounds Read

VBScript 5.8.7600.163855.8.9600.16384 - RegExpComp::PnodeParse Out-of-Bounds Read !-- Source: http://blog.skylined.nl/20161108001.html Synopsis A specially crafted script can cause the VBScript engine to read data beyond a memory block for use as a regular expression. An attacker that is able to...

Internet Explorer 9 MSHTML - CPtsTextParaclient::CountApes Out-of-Bounds Read

Microsoft Internet Explorer 9 suffers from a MSHTML CPtsTextParaclient::CountApes out-of-bounds read vulnerability. Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the third entry in that series. The below informati...

lcms2: Out-of-bounds read in Type_MLU_Read()

The TypeMLURead function in cmstypes.c in Little CMS aka lcms2 allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read...

CVE-2016-9189

A memory disclosure vulnerability was found in python-pillow. Functions in map.c failed to check for image overflow and check that an offset parameter was within bounds, allowing a crafted image to cause a crash or disclosure of memory...

Microsoft Internet Explorer 9 - MSHTML CPtsTextParaclient::CountApes Out-of-Bounds Read

Microsoft Internet Explorer 9 - MSHTML CPtsTextParaclient::CountApes Out-of-Bounds Read oElement1 position: absolute; oElement2:after position: relative; content: counterx; onload = function oElement1 = document.createElement'oElement1'; document.documentElement.appendChildoElement1; oElement2 =...

Microsoft Internet Explorer 9 - MSHTML CPtsTextParaclient::CountApes Out-of-Bounds Read

oElement1 position: absolute; oElement2:after position: relative; content: counterx; onload = function oElement1 = document.createElement'oElement1'; document.documentElement.appendChildoElement1; oElement2 = document.createElement'oElement2'; document.documentElement.appendChildoElement2; ; !--...

postgresql: CASE/WHEN with inlining can cause untrusted pointer dereference

A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code...

PHP 5.5.x < 5.5.35, 5.6.x < 5.6.21, 7.x < 7.0.6 Multiple Vulnerabilities

Binary data 802031.prm...

VMware Tools 9.x / 10.x < 10.1.0 Kernel Memory Address Disclosure (VMSA-2016-0017) (Mac OS X)

The version of VMware Tools installed on the remote macOS or Mac OS X host is 9.x or 10.x prior to 10.1.0. It is, therefore, affected by an information disclosure vulnerability in the System Integrity Protection SIP feature. A local attacker can exploit this issue to obtain kernel memory addresse...

Microsoft Windows Kernel - Registry Hive Loading Relative Arbitrary Read in nt!RtlValidRelativeSecurityDescriptor (MS16-123)

Microsoft Windows Kernel - Registry Hive Loading Relative Arbitrary Read in nt!RtlValidRelativeSecurityDescriptor MS16-123 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=876 We have encountered a Windows kernel crash in the nt!RtlValidRelativeSecurityDescriptor function invoked...

ImageMagick 'coders/tiff.c' memory leak vulnerability

ImageMagick is the United States ImageMagick Studio company's set of open source image processing software. A memory disclosure vulnerability exists in the 'coders/tiff.c' script in ImageMagick version 7.0.3.0, which can be exploited by an attacker to execute arbitrary code within the context of...

Google Chrome < 54.0.2840.59 Multiple Vulnerabilities

Binary data 9687.pasl...