Microsoft Windows - USP10!otlValueRecord::adjustPos Uniscribe Font Processing Out-of-Bounds Memory R

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1204 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!otlValueRecord::adjustPos function, while trying to display text using a corrupted TTF fon...

Microsoft Windows - USP10!ttoGetTableData Uniscribe Font Processing Out-of-Bounds Memory Read

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1199 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!ttoGetTableData function, while trying to display text using a corrupted TTF font file: --...

CVE-2017-8554

CVE-2017-8554 corresponds to a Windows kernel local information disclosure affecting Win32k.sys across multiple Windows versions. The CNVD-2017-12584 entry notes a local information disclosure in Win32k.sys exploitable via a crafted application to obtain memory contents. Microsoft security update...

CVE-2017-8579

The DirectX component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run arbitrary code in kernel mode via a specially crafted application, aka "DirectX Elevation of Privilege Vulnerability."...

CVE-2017-8554

The kernel in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an authenticated attacker to obtain memory contents via a specially crafted application...

Partner Perspectives: Using Cb Response to Mitigate ETERNALBLUE

Editor's Note: This post originally appeared on redcanary.com In case you’ve been under a rock, there’s a wee problem with ransomware, fueled by the public release of a handful of high quality access exploit and persistence backdoor utilities. Most recently, these have manifested in the form of t...

WikiLeaks Reveals How CIA Malware Tracks Geo-Location of its Targeted

WikiLeaks has just published a new batch of the ongoing Vault 7 leak, and this time the whistleblowing website has unveiled a classified malware for that tracks geo-location of targeted PCs and laptops running the Microsoft Windows operating system. In short, the malware does it by capturing the...

KLA11901 OSI vulnerability in Microsoft Products (ESU)

An information disclosure vulnerability was found in Microsoft Products Extended Support Update. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2017-8554 Related products Microsoft-Windows Microsoft-Windows-Server...

KLA11844 OSI vulnerability in Microsoft Windows

An information disclosure vulnerability was found in Microsoft Windows. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2017-8554 Related products Microsoft-Windows-Server-2012 Microsoft-Windows-8 Microsoft-Windows-7...

Microsoft Windows - nt!NtQueryInformationResourceManager (information class 0) Kernel Stack Memory D

Exploit for windows platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1207 We have discovered that the nt!NtQueryInformationResourceManager system call called with the 0 information class discloses portions of uninitialized kernel stack memory to...

Microsoft Windows - win32k!NtGdiMakeFontDir Kernel Stack Memory Disclosure Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1191 We have discovered that the win32k!NtGdiMakeFontDir system call discloses large portions of uninitialized kernel stack memory to user-mode clients. The attached proof of conce...

Microsoft Windows - win32k!NtGdiGetTextMetricsW Kernel Stack Memory Disclosure Exploit

Exploit for windows platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1180 We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 7 other systems untested through the...

Microsoft Windows - Kernel ATMFD.DLL Out-of-Bounds Read due to Malformed Name INDEX in the CFF Table

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1213 We have encountered a Windows kernel crash in the ATMFD.DLL OpenType driver while processing a corrupted OTF font file, see below: --- DRIVERPAGEFAULTBEYONDENDOFALLOCATION d6 ...

‘Petya’ Ransomware Outbreak Goes Global

A new strain of ransomware dubbed "Petya" is worming its way around the world with alarming speed. The malware is spreading using a vulnerability in Microsoft Windows that the software giant patched in March 2017 -- the same bug that was exploited by the recent and prolific WannaCry ransomware...

(Pwn2Own) Microsoft Windows WarpKMSubmitCommandVirtual Uninitialized Memory Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within BasicRender.sys,...

Microsoft Windows Graphics Component Information Disclosure Vulnerability(CVE-2017-0289)

We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!otlValueRecord::adjustPos function, while trying to display text using a corrupted TTF font file: --- 470.4d4: Access violation - code c0000005 first chance First chance exceptions are reported before any excepti...

Microsoft Windows Graphics Component Information Disclosure Vulnerability(CVE-2017-0288)

We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!otlReverseChainingLookup::apply function, while trying to display text using a corrupted TTF font file: --- 678.6c8: Access violation - code c0000005 first chance First chance exceptions are reported before any...

Microsoft Windows - 'USP10!MergeLigRecords' Uniscribe Font Processing Heap Memory Corruption

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1198 We have encountered a crash in the Windows Uniscribe user-mode library, in the memmove function called by USP10!MergeLigRecords, while trying to display text using a corrupted font file: --- 4e0.6dc: Access violation - code...

Microsoft Windows - USP10!SubstituteNtoM Uniscribe Font Processing Out-of-Bounds Memory Read

Microsoft Windows - USP10!SubstituteNtoM Uniscribe Font Processing Out-of-Bounds Memory Read Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1200 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!SubstituteNtoM function, while trying to display...

Microsoft Windows - USP10!CreateIndexTable Uniscribe Font Processing Out-of-Bounds Memory Read

Microsoft Windows - USP10!CreateIndexTable Uniscribe Font Processing Out-of-Bounds Memory Read Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1201 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!CreateIndexTable function, while trying to...