Firefox RCE

The vulnerability of the Firefox browser in the OMTC component lies in the use of the memset function for a memory area with a negative length value when interacting with the mozilla::layers::BufferTextureClient::AllocateForSurface function. Exploiting this vulnerability allows a malicious actor ...

Firefox RCE

The vulnerability of the Firefox browser in the OMTC component lies in the incorrect invocation of the memset function when interacting with the mozilla::layers::BufferTextureClient::AllocateForSurface function. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or...

Android - ih264d_process_intra_mb Memory Corruption

Exploit for Android platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=523 The attached file causes a crash in ih264dprocessintramb in avc parsing, likely due to incorrect bounds checking in one of the memcpy or memset calls in the method. The file...

Google Android - 'ih264d_process_intra_mb' Memory Corruption

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=523 The attached file causes a crash in ih264dprocessintramb in avc parsing, likely due to incorrect bounds checking in one of the memcpy or memset calls in the method. The file crashes with the following stack trace in M: 09-08...

Linux/x86-64 - shell_reverse_tcp with Password Polymorphic Shellcode (1) (122 bytes)

/--------------------------------------------------------------------------------------------------------------------- / Title: tcp reverse shell with password polymorphic version 122 bytes Author: Sathish kumar Contact: https://www.linkedin.com/in/sathish94 Copyright: c 2016 iQube. http://iQube....

Adobe Flash BlurFilter Processing - Out-of-Bounds Memset

Adobe Flash BlurFilter Processing - Out-of-Bounds Memset Source: https://code.google.com/p/google-security-research/issues/detail?id=627 The attached swf file causes an out-of-bounds memset in BlurFilter processing. Note that Chrome aborts when processing the swf Proof of Concept:...

Adobe Flash BlurFilter Processing - Out-of-Bounds Memset

Exploit for multiple platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=627 The attached swf file causes an out-of-bounds memset in BlurFilter processing. Note that Chrome aborts when processing the swf Proof of Concept:...

Adobe Flash BlurFilter Processing - Out-of-Bounds Memset

Source: https://code.google.com/p/google-security-research/issues/detail?id=627 The attached swf file causes an out-of-bounds memset in BlurFilter processing. Note that Chrome aborts when processing the swf Proof of Concept:...

Samsung Galaxy S6 Samsung Gallery - Bitmap Decoding Crash

Samsung Galaxy S6 Samsung Gallery - Bitmap Decoding Crash Source: https://code.google.com/p/google-security-research/issues/detail?id=497 Loading the bitmap bmpmemset.bmp can cause a crash due to a memset writing out of bounds. I/DEBUG 2961: pid: 12383, tid: 12549, name: thread-pool-1...

FreeBSD : cups-filters -- texttopdf integer overflow (bf1d9331-21b6-11e5-86ff-14dae9d210b8)

Stefan Cornelius from Red Hat reports : An integer overflow flaw leading to a heap-based buffer overflow was discovered in the way the texttopdf utility of cups-filter processed print jobs with a specially crafted line size. An attacker being able to submit print jobs could exploit this flaw to...

cups-filters -- texttopdf integer overflow

Stefan Cornelius from Red Hat reports: An integer overflow flaw leading to a heap-based buffer overflow was discovered in the way the texttopdf utility of cups-filter processed print jobs with a specially crafted line size. An attacker being able to submit print jobs could exploit this flaw to...

Memory corruption

The Off Main Thread Compositing OMTC implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code o...

CVE-2015-0806

CVE-2015-0806 affects Mozilla Firefox prior to 37.0, where the OMTC path may call memset on a negative-length memory region during interaction with mozilla::layers::BufferTextureClient::AllocateForSurface. This can enable a remote attacker to execute arbitrary code or cause a memory corruption-ba...

UBUNTU-CVE-2015-0805

The Off Main Thread Compositing OMTC implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service...

DLA-23-1 nss - security update

Bulletin has no description...

openSUSE Security Update : samba (openSUSE-SU-2013:1921-1)

" - Update to 4.1.3. + DCE-RPC fragment length field is incorrectly checked; CVE-2013-4408; bnc844720. + pamwinbind login without requiremembershipof restrictions; CVE-2012-6150; bnc853347. - Make use of the full gpg pub key file name including the key ID. - Add transparent file compression...

Scientific Linux Security Update : glibc on SL5.x i386/x86_64 (20131008)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in glibc's memory allocator functions pvalloc, valloc, and memalign. If an application used such a function, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of t...

GNU glibc - strcoll() Routine Integer Overflow

GNU glibc - strcoll Routine Integer Overflow // source: https://www.securityfocus.com/bid/55462/info GNU glibc is prone to a remote integer-overflow vulnerability which leads to buffer overflow vulnerability. Successful exploits may allow an attacker to execute arbitrary code in the context of a...

CVE-2011-3489

RnaUtility.dll in RsvcHost.exe 2.30.0.23 in Rockwell RSLogix 19 and earlier allows remote attackers to cause a denial of service crash via a crafted rna packet with a long string to TCP port 4446 that triggers 1 "a memset zero overflow" or 2 an out-of-bounds read, related to improper handling of ...

CVE-2011-3489

RnaUtility.dll in RsvcHost.exe 2.30.0.23 in Rockwell RSLogix 19 and earlier allows remote attackers to cause a denial of service crash via a crafted rna packet with a long string to TCP port 4446 that triggers 1 "a memset zero overflow" or 2 an out-of-bounds read, related to improper handling of ...