Linux Kernel <= 2.6.20 with DCCP Support Memory Disclosure Exploit

No description provided by source. / Linux Kernel DCCP Memory Disclosure Vulnerability Synopsis: The Linux kernel is susceptible to a locally exploitable flaw which may allow local users to steal data from the kernel memory. Vulnerable Systems: Linux Kernel Versions: = 2.6.20 with DCCP support...

MOPB-29-2007:PHP 5.2.1 unserialize() Information Leak Vulnerability

Summary The new S: data type added to PHP 5.2.1's serialisation format is completely broken. The new feature it is supposed to add, the handling of escaped strings does not work at all and leads to disclosure of heap memory content. Affected versions Affected is PHP 5.2.1 Detailed information Wit...

php session extension information leak

The phpbinary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information memory contents via a serialized variable entry with a large length value, which triggers a buffer over-read...

security flaw

The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the keylength variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name befo...

USN-430-1: mod_python vulnerability

Miles Egan discovered that modpython, when used in output filter mode, did not handle output larger than 16384 bytes, and would display freed memory, possibly disclosing private data. Thanks to Jim Garrison of the Software Freedom Law Center for identifying the original bug as a security...

Plan 9 Kernel (devenv.c OTRUNC/pwrite) Local Exploit

No description provided by source. / !!! DO NOT DISTRIBUTE !!! / / identity theft this exploit uses my devenv.c OTRUNC/pwrite vulnerability to overwrite specific kernel addresses to help elevate our privileges. this exploit is very picky, so you must understand the plan9 kernel and know what you...

Plan 9 Kernel - 'devenv.c OTRUNC/pwrite' Local Privilege Escalation

/ !!! DO NOT DISTRIBUTE !!! / / identity theft this exploit uses my devenv.c OTRUNC/pwrite vulnerability to overwrite specific kernel addresses to help elevate our privileges. this exploit is very picky, so you must understand the plan9 kernel and know what you are doing, though a best-practice...

php session extension information leak

The phpbinary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information memory contents via a serialized variable entry with a large length value, which triggers a buffer over-read...

php session extension information leak

The phpbinary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information memory contents via a serialized variable entry with a large length value, which triggers a buffer over-read...

Fedora Core 5 : php-5.1.4-1 (2006-289)

This update includes the latest release of PHP 5, version 5.1.4. This release includes fixes for several security issues and many bug fixes. The phpinfo PHP function did not properly sanitize long strings. An attacker could use this to perform cross-site scripting attacks against sites that have...

MS Windows NtRaiseHardError Csrss.exe-winsrv.dll Double Free

No description provided by source. ///////////////////////////////////////// ///////////////////////////////////////// ///// Microsoft Windows NtRaiseHardError ///// Csrss.exe-winsrv.dll Double Free ///////////////////////////////////////// ///// Ruben Santamarta ///// ruben at reversemode dot co...

MS Windows NtRaiseHardError Csrss.exe-winsrv.dll Double Free

Exploit for unknown platform in category dos / poc ============================================================ MS Windows NtRaiseHardError Csrss.exe-winsrv.dll Double Free ============================================================ /////////////////////////////////////////...

MS Windows NtRaiseHardError Csrss.exe Memory Disclosure Exploit

No description provided by source. ///////////////////////////////////////// ///////////////////////////////////////// ///// Microsoft Windows NtRaiseHardError ///// Csrss.exe memory disclosure ///////////////////////////////////////// ///// Ruben Santamarta ///// ruben at reversemode dot com ///...

csrssexe.txt

Hi, I have been taking a look at the NtRaiseHardError bug and just for fun I've coded an exploit. Watch out, not for the double free vulnerability indeed I have not analyzed that piece of code yet but just relying on NtRaiseHardError internals and how is dispatched a MessageBox with...

Microsoft Windows - NtRaiseHardError Csrss.exe Memory Disclosure

Microsoft Windows - NtRaiseHardError Csrss.exe Memory Disclosure ///////////////////////////////////////// ///////////////////////////////////////// ///// Microsoft Windows NtRaiseHardError ///// Csrss.exe memory disclosure ///////////////////////////////////////// ///// Ruben Santamarta /////...

MS Windows NtRaiseHardError Csrss.exe Memory Disclosure Exploit

Exploit for unknown platform in category local exploits =============================================================== MS Windows NtRaiseHardError Csrss.exe Memory Disclosure Exploit =============================================================== /////////////////////////////////////////...

Microsoft Windows - NtRaiseHardError 'Csrss.exe' Memory Disclosure

///////////////////////////////////////// ///////////////////////////////////////// ///// Microsoft Windows NtRaiseHardError ///// Csrss.exe memory disclosure ///////////////////////////////////////// ///// Ruben Santamarta ///// ruben at reversemode dot com ///// www.reversemode.com...

FreeBSD Security Advisory FreeBSD-SA-06:25.kmem

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-06:25.kmem Security Advisory The FreeBSD Project Topic: Kernel memory disclosure in firewire4 Category: core Module: sysdev Announced: 2006-12-06 Credits: Rodrigo...

FreeBSD-SA-06:25.kmem

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-06:25.kmem Security Advisory The FreeBSD Project Topic: Kernel memory disclosure in firewire4 Category: core Module: sysdev Announced: 2006-12-06 Credits: Rodrigo...

FreeBSD -- Kernel memory disclosure in firewire(4)

Problem Description: In the FWGCROM ioctl, a signed integer comparison is used instead of an unsigned integer comparison when computing the length of a buffer to be copied from the kernel into the calling application. Impact: A user in the "operator" group can read the contents of kernel memory...