CVE-2018-14455

An issue was discovered in libgig 4.1.0. There is an out-of-bounds write in pData0 access in the function store32 in helper.h...

CVE-2018-14458

An issue was discovered in libgig 4.1.0. There is a heap-based buffer overflow in pData1 access in the function store32 in helper.h...

CVE-2018-14453

An issue was discovered in libgig 4.1.0. There is a heap-based buffer overflow in pData1 access in the function store16 in helper.h...

CVE-2018-14455

The CVE-2018-14455 issue affects libgig 4.1.0, where an out-of-bounds write occurs in pData[0] access within the store32 function in helper.h. Multiple connected sources corroborate this exact flaw. One CNVD-2018-15168 description further notes that an attacker could exploit this by tricking a us...

CVE-2018-14453

CVE-2018-14453 affects libgig 4.1.0 with a heap-based buffer overflow in pData[1] access within the store16 function in helper.h. Supported documents consistently describe the vulnerability as a heap overflow; exploitation details, affected products/versions beyond 4.1.0, and fixes are not provid...

CVE-2018-14453

An issue was discovered in libgig 4.1.0. There is a heap-based buffer overflow in pData1 access in the function store16 in helper.h...

CVE-2018-14459

An issue was discovered in libgig 4.1.0. There is an out-of-bounds write in pData0 access in the function store16 in helper.h...

Disassembler and Runtime Analysis

This post was authored by Paul Rascagneres.IntroductionIn the CCleaner 64bit stage 2 previously described in our blog, we explained that the attacker modified a legitimate executable that is part of "Symantec Endpoint". This file is named EFACli64.dll. The modification is performed in the runtime...

AOL dnUpdater ActiveX dnu.exe Init() Method Remote Code Execution

The remote host has an install of the AOL dnUpdater ActiveX control dnu.exe prior to version 1.1.25.1. As such, it reportedly does not properly verify the function pointer passed by the 'pData' argument of the control's 'Init' method. A remote attacker could exploit this vulnerability by tricking...