KLA11123 PE vulnerability in Xamarin.iOS

A serious vulnerability in the Xamarin.iOS can be exploited locally to gain privileges. Technical details To exploit this vulnerability, an attacker would have to log on to an affected system and create a folder at a particular location. which could be used by another process running with elevate...

Wolf in sheep's clothing: how to use the Windows icon to display the vulnerability disguise a PE file-vulnerability warning-the black bar safety net

One, Foreword Windows System icon to display the function in the presence of a vulnerability, exploit this vulnerability, the attacker may be from the local host to automatically “borrow“ other commonly used icons, use these icon camouflage PE file, thereby tempting the user to click on such a...

The Windows Malware Analysis Distribution: flare-vm

FLARE VM is a freely available and open sourced Windows-based security distribution designed for reverse engineers, malware analysts, incident responders, forensicators, and penetration testers. Inspired by open-source Linux-based security distributions like Kali Linux, REMnux and others, FLARE V...

CVE-2017-6420

The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service use-after-free via a crafted PE file with WWPack compression...

Design/Logic Flaw

The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service use-after-free via a crafted PE file with WWPack compression...

CVE-2017-6420

The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service use-after-free via a crafted PE file with WWPack compression...

CVE-2017-6420

The CVE-2017-6420 issue affects ClamAV up to version 0.99.2, where the wwunpack function in libclamav/wwunpack.c is vulnerable to a remote use-after-free via a crafted PE file with WWPack compression, potentially causing a denial of service. Upstream fixed this in version 0.99.3 (and distribution...

CVE-2017-6420

The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service use-after-free via a crafted PE file with WWPack compression...

CVE-2017-6420

The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service use-after-free via a crafted PE file with WWPack compression...

ClamAV Denial of Service Vulnerability (CNVD-2017-26574)

ClamAV Clam AntiVirus is a free and open source antivirus program developed by the ClamAV team. The software is used to detect Trojans, viruses, malware and other malicious threats. A denial of service vulnerability exists in the 'wwunpack' function of the libclamav/wwunpack.c file in ClamAV...

CVE-2017-6420

The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service use-after-free via a crafted PE file with WWPack compression...

UBUNTU-CVE-2017-6420

The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service use-after-free via a crafted PE file with WWPack compression...

USN-3367-1: gdb vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Hanno Böck discovered that gdb incorrectly handled certain malformed AOUT headers in PE executables. If a user or automated system were tricked into processing a specially crafted binary, a remote attacke...

CVE-2016-10402

Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large relative virtual address in a PE file, causing an integer overflow and heap-based buffer underflow...

USN-3367-1: gdb vulnerabilities

Hanno Böck discovered that gdb incorrectly handled certain malformed AOUT headers in PE executables. If a user or automated system were tricked into processing a specially crafted binary, a remote attacker could use this issue to cause gdb to crash, resulting in a denial of service, or possibly...

KLA11845 Multiple vulnerabilities in Microsoft Exchange Server

Multiple vulnerabilities were found in Microsoft Exchange Server. Malicious users can exploit these vulnerabilities to spoof user interface, gain privileges. Below is a complete list of vulnerabilities: 1. Security UI vulnerability in Microsoft Exchange can be exploited remotely via specially...

PPEE (Puppy) - Professional PE file Explorer for reversers and malware researchers

There are lots of tools out there for statically analyzing malicious binaries, but they are ordinary tools for ordinary files. Puppy is a lightweight yet strong tool for static investigation of suspicious files. A companion plugin is also provided to query the file in the well-known malware...

Professional PE file Explorer: PPEE

Professional PE file Explorer Puppy is a lightweight yet strong tool for static investigation of suspicious files. A companion plugin is also provided to query the file in the well-known malware repositories and take one-click technical information about the file such as its size, entropy,...

CAVE MINER - Search for Code Cave in All Binaries (ELF, PE and Mach-o) and Inject Payload

This tools search for code cave in binaries Elf, Mach-o, Pe, and inject code in them. Features Find code caves in ELF, PE and Mach-o Use custom bytes for the search ex: 0xCC can be used as nullbytes on PE See virtual address of the code cave. See the permissions of the code caves. Search custom...

KLA11040 Elevation of privilege vulnerability in Microsoft Windows

An improper handling of objects in memory in Windows kernel-mode driver was found in Microsoft Windows. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited remotely via a specially designed application by a malicious user who has logged on to...