Microsoft Windows - Kernel NtGdiGetTextExtentExW Out-of-Bounds Memory Read

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=685 The attached Proof-of-Concept crashes Windows 7 with special pool enabled on win32k.sys. The crash is due accessing memory past the end of a buffer. Proof of Concept:...

Microsoft Windows Kernel - 'NtGdiGetTextExtentExW' Out-of-Bounds Memory Read

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=685 The attached Proof-of-Concept crashes Windows 7 with special pool enabled on win32k.sys. The crash is due accessing memory past the end of a buffer. Proof of Concept:...

Foxit Reader ConvertToPDF BMP Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ConvertToPDF...

The vulnerability of the OpenSSL library, which allows a hacker to trigger a service failure or cause other adverse effects

The vulnerability of the fmtstr function in the OpenSSL library crypto/bio/bprint.c is caused by buffer overflow. Exploiting this vulnerability could allow an attacker to cause a service failure or other effects such as reading beyond the memory boundaries using a long ASN.1 data string...

libxml2 - xmlDictAddString Heap Based Buffer Overread

Exploit for linux platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=637 The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of latest stable libxml2 2.9.3, released 4 days ago, by feeding a...

libxml2 - xmlParseEndTag2 Heap Buffer Overread

libxml2 - xmlParseEndTag2 Heap Buffer Overread Source: https://code.google.com/p/google-security-research/issues/detail?id=638 The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of latest stable libxml2 2.9.3, released 4 days ago, by feeding a...

libxml2 - xmlParserPrintFileContextInternal Heap Buffer Overread

Source: https://code.google.com/p/google-security-research/issues/detail?id=639 The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of latest stable libxml2 2.9.3, released 4 days ago, by feeding a malformed file to xmllint "$ ./xmllint /path/to/file...

libxml2 - htmlCurrentChar Heap Buffer Overread

Source: https://code.google.com/p/google-security-research/issues/detail?id=636 The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of latest stable libxml2 2.9.3, released 4 days ago, by feeding a malformed file to xmllint "$ ./xmllint --html...

libxml2 - htmlCurrentChar Heap Buffer Overread

libxml2 - htmlCurrentChar Heap Buffer Overread Source: https://code.google.com/p/google-security-research/issues/detail?id=636 The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of latest stable libxml2 2.9.3, released 4 days ago, by feeding a...

libxml2 - xmlParserPrintFileContextInternal Heap Buffer Overread

libxml2 - xmlParserPrintFileContextInternal Heap Buffer Overread Source: https://code.google.com/p/google-security-research/issues/detail?id=639 The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of latest stable libxml2 2.9.3, released 4 days ago, ...

libxml2 - htmlCurrentChar Heap Based Buffer Overread

Exploit for linux platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=636 The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of latest stable libxml2 2.9.3, released 4 days ago, by feeding a...

libxml2 - xmlDictAddString Heap Buffer Overread

Source: https://code.google.com/p/google-security-research/issues/detail?id=637 The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of latest stable libxml2 2.9.3, released 4 days ago, by feeding a malformed file to xmllint "$ ./xmllint --html...

libxml2 - xmlParserPrintFileContextInternal Heap Based Buffer Overread

Exploit for linux platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=639 The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of latest stable libxml2 2.9.3, released 4 days ago, by feeding a...

libxml2 - xmlParseEndTag2 Heap Buffer Overread

Source: https://code.google.com/p/google-security-research/issues/detail?id=638 The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of latest stable libxml2 2.9.3, released 4 days ago, by feeding a malformed file to xmllint "$ ./xmllint /path/to/file...

Google Chrome Pdfium JPEG2000 Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

SUSE SLED11 / SLES11 Security Update : postgresql94 (SUSE-SU-2016:0482-1)

This update of postgresql94 to 9.4.5 fixes the following issues : - CVE-2015-5289: json or jsonb input values constructed from arbitrary user input could have crashed the PostgreSQL server and caused a denial of service bsc949670 - CVE-2015-5288: crypt pgCrypto extension couldi potentially be...

USN-2877-1 oxide-qt vulnerabilities

A bad cast was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. CVE-2016-1612 An issue was...

chromium-browser: information leak in Blink

The UnacceleratedImageBufferSurface class in WebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp in Blink, as used in Google Chrome before 48.0.2564.82, mishandles the initialization mode, which allows remote attackers to obtain sensitive information from process memory via a...

Amazon Linux: Security Advisory (ALAS-2016-633)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2016-634)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...