PHP 5.4 Win32 Code Execution

// Exploit Title: PHP 5.4 5.4.3 Code Execution 0day Win32 // Exploit author: 0in Maksymilian Motyl // Email: 0indotemailatgmail.com // Bug with Variant type parsing originally discovered by Condis // Tested on Windows XP SP3 fully patched Polish =================== offset-brute.html...

PHP 5.4.3 (Windows x86 Polish) - Code Execution

// Exploit Title: PHP 5.4 5.4.3 Code Execution 0day Win32 // Exploit author: 0in Maksymilian Motyl // Email: 0indotemailatgmail.com // Bug with Variant type parsing originally discovered by Condis // Tested on Windows XP SP3 fully patched Polish =================== offset-brute.html...

MP3-Nator Buffer Overflow SEH-DEP Bypass

Exploit Title: Exploit Buffer Overflow MP3-Nator SEH - DEP BYPASS Date: 18-11-2010 Author: Muhamad Fadzil Ramli - mind1355atgmaildotcom Credit/Bug Found By: C4SS!0 G0M3S Software Link: http://www.brothersoft.com/d.php?softid=16524&url=http://files.brothersoft.com/mp3audio/players/mp3nator.zip...

MP3-Nator Buffer Overflow (SEH - DEP BYPASS)

Exploit for windows platform in category local exploits ============================================ MP3-Nator Buffer Overflow SEH - DEP BYPASS ============================================ Exploit Title: Exploit Buffer Overflow MP3-Nator SEH - DEP BYPASS Date: 18-11-2010 Author: Muhamad Fadzil...

MP3-Nator - Local Buffer Overflow (SEH) (DEP Bypass)

Exploit Title: Exploit Buffer Overflow MP3-Nator SEH - DEP BYPASS Date: 18-11-2010 Author: Muhamad Fadzil Ramli - mind1355atgmaildotcom Credit/Bug Found By: C4SS!0 G0M3S Software Link: http://www.brothersoft.com/d.php?softid=16524&url=http://files.brothersoft.com/mp3audio/players/mp3nator.zip...

wef-study.txt

Windows Extended file attributes buffer overflow Study II In a previous article , i write about extended file attributes: "A local buffer overflow exists in the windows explorer . The extended file atributes functions have a small size of the buffer in 'FileAllInformation,FileNameInformation' and...

Microsoft Windows OLE32.DLL Word文档处理拒绝服务漏洞

Microsoft Windows是微软发布的非常流行的操作系统。 Windows的OLE32.DLL库处理畸形DOC文档时存在漏洞，可能导致资源器在访问文档时发生崩溃。 Windows的OLE32.DLL库在处理包含有超大文件大小值的.doc文档时存在错误的指针应用。用户不必打开恶意的文档，只要将光标移动至该文档的图标就会导致资源管理器崩溃。 Microsoft Windows XP SP2 Microsoft Windows 2000SP4 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Memory corruption

Microsoft Windows Explorer on Windows 2000 SP4 FR and XP SP2 FR, and possibly other versions and platforms, allows remote attackers to cause a denial of service memory corruption and crash via an Office file with crafted document summary information, which causes an error in Ole32.dll...

CVE-2007-1347

Microsoft Windows Explorer on Windows 2000 SP4 FR and XP SP2 FR, and possibly other versions and platforms, allows remote attackers to cause a denial of service memory corruption and crash via an Office file with crafted document summary information, which causes an error in Ole32.dll...

CVE-2007-1347

CVE-2007-1347 affects Microsoft Windows Explorer on Windows 2000 SP4 FR and XP SP2 FR (and possibly other versions). The issue arises when processing an Office file with crafted document summary information, causing a memory corruption in Ole32.dll and a denial of service (memory corruption and c...

MS Windows (.doc File) Malformed Pointers Denial of Service Exploit

No description provided by source. / Microsoft Windows .doc File Malformed Pointers DoS &...

Microsoft Windows fails to properly handle malformed OLE documents

Overview A vulnerability exists in a Microsoft Windows library that is used to handle OLE documents. The complete impact of this vulnerability is not clear, but may include the execution of arbitrary code as well as a denial of service. Description Microsoft OLE documents include summary...

Microsoft Windows - .doc Malformed Pointers Denial of Service

Microsoft Windows - .doc Malformed Pointers Denial of Service /\ Microsoft Windows .doc File Malformed Pointers DoS Just move your mouse on the file and explorer crashes. If it does not try to look at file properties. Bug comes from Ole32.dll: CMP DWORD PTR DS:EAX+EBX,3 and we can set EAX, EDX an...

MS Windows (.doc File) Malformed Pointers Denial of Service Exploit

Exploit for unknown platform in category dos / poc =================================================================== MS Windows .doc File Malformed Pointers Denial of Service Exploit =================================================================== /\ Microsoft Windows .doc File Malformed...

Microsoft Windows - '.doc' Malformed Pointers Denial of Service

/\ Microsoft Windows .doc File Malformed Pointers DoS Just move your mouse on the file and explorer crashes. If it does not try to look at file properties. Bug comes from Ole32.dll: CMP DWORD PTR DS:EAX+EBX,3 and we can set EAX, EDX and ESI with arbitrary values. Check the file, magic offsets are...

MS Office Outlook Recipient Control (ole32.dll) Denial of Service Exploit

No description provided by source. !-- ------------------------------------------------------------------------ Microsoft Office Outlook Recipient Control ole32.dll Denial of Service author: shinnai site: http://shinnai.altervista.org mail: shinnaiatautisticidotorg and, always, special thanks to...

Microsoft Office Outlook Recipient Control - ole32.dll Denial of Service

Microsoft Office Outlook Recipient Control - ole32.dll Denial of Service milw0rm.com 2006-12-18...

MS Office Outlook Recipient Control (ole32.dll) Denial of Service Exploit

Exploit for unknown platform in category dos / poc ========================================================================= MS Office Outlook Recipient Control ole32.dll Denial of Service Exploit ========================================================================= 0day.today 2018-04-02...

Microsoft Office Outlook Recipient Control - 'ole32.dll' Denial of Service

milw0rm.com 2006-12-18...

CVE-2006-1540

MSO.DLL in Microsoft Office 2000, Office XP 2002, and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary code via multiple attack vectors, as originally demonstrated using a crafted document record with a malformed string, as demonstrated by replacing a...