CVE-2008-4326

The PMAescapeJsString function in libraries/jsescape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via a NUL byte inside a "...

SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2019:2514-1)

This update for dovecot23 fixes the following issues : CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. bsc1145559 CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel bsc1133625. CVE-2019-11494: Fixed a denia...

SUSE-SU-2019:2514-1 Security update for dovecot23

This update for dovecot23 fixes the following issues: - CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. bsc1145559 - CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel bsc1133625. - CVE-2019-11494: Fixed a...

Updated dovecot packages fix security vulnerability

Updated dovecot packages fix security vulnerability: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes...

Dovecot -- improper input validation

Aki Tuomi reports: Vulnerability Details: IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Risk: This vulnerability allows for out-of-bounds writes to objects stored on the heap up to 8096 byte...

Mail.ru: touch.mail.ru / e.mail.ru memory content disclosure

An invalid handling of NUL byte in API request led to disclosure of HTTP server memory region. The root cause of this bug is tracked to nginx+openresty. An advisory is below: Insecure implementation of nginx rewrite / OpenResty ngx.req.seturi + memory content leak in nginx. OpenResty is LUA engin...

Unintentional directory traversal by poisoned NUL byte in Dir

There is an unintentional directory traversal in some methods in Dir Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the target directory as their parameter. If the parameter contains NUL \0 bytes, these methods recognize that the path is completed before the NUL bytes. So, if a...

ruby -- multiple vulnerabilities

Ruby news: CVE-2017-17742: HTTP response splitting in WEBrick If a script accepts an external input and outputs it without modification as a part of HTTP responses, an attacker can use newline characters to deceive the clients that the HTTP response header is stopped at there, and can inject fake...

Apple: OOB NUL byte write when handling WLC_E_TRACE event packets(CVE-2017-7112)

Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. On iOS, the "AppleBCMWLANBusInterfacePCIe"...

Apple Out-Of-Bounds NUL Byte Write Vulnerability

Exploit for macOS platform in category dos / poc Apple: OOB NUL byte write when handling WLCETRACE event packets CVE-2017-7112 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are...

Mail.ru: При передаче в ID сообщения нулевого байта, происходит вывод какого-то буфера.

Memory leak due to invalid NUL-byte processing aka "poison NULL byte" problem on message reading via crafted message id allowed to read a portion of server's heap memory at uncontrolled location. This portion could potentially contain sensitive data...

openafs -- local DoS vulnerability

The OpenAFS development team reports: Avoid a potential denial of service issue, by fixing a bug in pioctl logic that allowed a local user to overrun a kernel buffer with a single NUL byte...

php security and bug fix update

5.4.16-36 - fix more functions accept paths with NUL character 1213407 5.4.16-35 - core: fix multipart/form-data request can use excessive amount of CPU usage CVE-2015-4024 - fix various functions accept paths with NUL character CVE-2015-4025, CVE-2015-4026, 1213407 - fileinfo: fix denial of...

openSUSE Security Update : php5 (openSUSE-SU-2014:1133-1)

php5 was updated to fix three security issues : - Insecure temporary file use for cache data was fixed by switching to a different root only directory /var/cache/php-pear CVE-2014-5459 - An incomplete fix for CVE-2014-4049 CVE-2014-3597 - gd extension: NUL byte injection in filenames passed to...

glibc - NUL Byte gconv_translit_find Off-by-One

glibc - NUL Byte gconvtranslitfind Off-by-One // // Full Exploit: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/34421.tar.gz CVE-2014-5119.tar.gz // // // --------------------------------------------------- // CVE-2014-5119 glibc gconvtranslitfind exploit //...

glibc - NUL Byte gconv_translit_find Off-by-One

// // Full Exploit: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34421.tar.gz CVE-2014-5119.tar.gz // // // --------------------------------------------------- // CVE-2014-5119 glibc gconvtranslitfind exploit // ------------------------ taviso & scarybeasts ---...

serf certificate name spoofing vulnerability

Certificate spoofing via NUL byte...

The poisoned NUL byte, 2014 edition

Posted by Chris Evans, Exploit Writer Underling to Tavis Ormandy Back in this 1998 post to the Bugtraq mailing list, Olaf Kirch outlined an attack he called “The poisoned NUL byte”. It was an off-by-one error leading to writing a NUL byte outside the bounds of the current stack frame. On i386...

Authentication Bypass

Overview Affected versions of this package are vulnerable to Authentication Bypass. The 1 serfsslcertissuer, 2 serfsslcertsubject, and 3 serfsslcertcertificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name CN...

CVE-2014-3504

The 1 serfsslcertissuer, 2 serfsslcertsubject, and 3 serfsslcertcertificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof...