7538 matches found
Code injection
Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service segmentation fault via unspecified vectors...
CVE-2016-7513
Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service segmentation fault via unspecified vectors...
CVE-2016-7513
Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service segmentation fault via unspecified vectors...
CVE-2016-7513
Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service segmentation fault via unspecified vectors...
CVE-2016-7513: Undefined Security Weakness
Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service segmentation fault via unspecified vectors...
kernel: Off-by-one error in selinux_setprocattr (/proc/self/attr/fscreate)
A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files. An empty null write to this file can crash the system by causing the system to attempt to access unmapped kernel memory...
kernel: Off-by-one error in selinux_setprocattr (/proc/self/attr/fscreate)
A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files. An empty null write to this file can crash the system by causing the system to attempt to access unmapped kernel memory...
openSUSE Security Update : pidgin (openSUSE-2017-457)
This update for pidgin to version 2.12.0 fixes the following issues : This security issue was fixed : - CVE-2017-2640: Out of bounds memory read in purplemarkupunescapeentity boo1028835. These non-security issues were fixed : + libpurple : - Fix the use of uninitialised memory if running...
Hot Wheels: Race Off - Dangerous filesystem permissions, Exported ContentProvider, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Hot Wheels: Race Off published at the 'play' market has multiple vulnerabilities...
CVE-2017-7301
The Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, has an aoutlinkaddsymbols function in bfd/aoutx.h that has an off-by-one vulnerability because it does not carefully check the string offset. The vulnerability could lead to a GNU linker ld program crash...
macOS Kernel 10.12.3 (16D32) - audit_pipe_open Off-by-One Memory Corruption Exploit
Exploit for macOS platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1126 MacOS kernel memory corruption due to off-by-one in auditpipeopen auditpipeopen is the special file open handler for the auditpipe device major number 10. Here's the code:...
Apple macOSiOS Kernel 10.12.3 (16D32) - SIOCGIFORDER Socket ioctl Off-by-One Memory Corruption
Apple macOSiOS Kernel 10.12.3 16D32 - SIOCGIFORDER Socket ioctl Off-by-One Memory Corruption / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1111 SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the ifnetorderedhead linked list of interfaces...
macOS / iOS Kernel 10.12.3 (16D32) - SIOCGIFORDER Socket ioctl Off-by-One Memory Corruption
Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1111 SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the ifnetorderedhead linked list of interfaces. SIOCSIFORDER clears the existing list and allow...
MacOS/iOS kernel memory corruption due to off-by-one in SIOCGIFORDER socket ioctl (CVE-2017-2474)
SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the ifnetorderedhead linked list of interfaces. SIOCSIFORDER clears the existing list and allows userspace to specify an array of interface indexes used to build a new list. SIOCGIFORDER allow userspace to query the list...
MacOS kernel memory corruption due to off-by-one in audit_sdev_open (CVE-2017-2483)
The auditsession device has a copy-pasted version of the same bug as the auditpipe device: static int auditsdevopendevt dev, unused int flags, unused int devtype, proct p struct auditsdev asdev; struct auditinfoaddr aia; int u; u = minordev; if u MAXAUDITSDEVS return ENXIO; void auditsdevgetaiap,...
Apple macOS Kernel 10.12.3 (16D32) - audit_pipe_open Off-by-One Memory Corruption
Apple macOS Kernel 10.12.3 16D32 - auditpipeopen Off-by-One Memory Corruption / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1126 MacOS kernel memory corruption due to off-by-one in auditpipeopen auditpipeopen is the special file open handler for the auditpipe device major...
Apple macOS Kernel 10.12.3 (16D32) - 'audit_pipe_open' Off-by-One Memory Corruption
/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1126 MacOS kernel memory corruption due to off-by-one in auditpipeopen auditpipeopen is the special file open handler for the auditpipe device major number 10. Here's the code: static int auditpipeopendevt dev, unused int flags,...
Apple macOS/iOS Kernel 10.12.3 (16D32) - SIOCGIFORDER Socket ioctl Off-by-One Memory Corruption
/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1111 SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the ifnetorderedhead linked list of interfaces. SIOCSIFORDER clears the existing list and allows userspace to specify an array of interface indexes...
Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY)
Mandiant has observed APT29 using a stealthy backdoor that we call POSHSPY. POSHSPY leverages two of the tools the group frequently uses: PowerShell and Windows Management Instrumentation WMI. In the investigations Mandiant has conducted, it appeared that APT29 deployed POSHSPY as a secondary...
Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY)
Mandiant has observed APT29 using a stealthy backdoor that we call POSHSPY. POSHSPY leverages two of the tools the group frequently uses: PowerShell and Windows Management Instrumentation WMI. In the investigations Mandiant has conducted, it appeared that APT29 deployed POSHSPY as a secondary...