chromium -- multiple vulnerabilities

Chrome Releases reports: This update includes 4 security fixes: 1452137 High CVE-2023-3420: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2023-06-07 1447568 High CVE-2023-3421: Use after free in Media. Reported by Piotr Bania of Cisco Talos on 2023-05-22 1450397 High...

Vulnerability Spotlight: Denial-of-service vulnerability in NVIDIA driver

Piotr Bania of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Executive summaryThe NVWGF2UMXCFG.DLL driver contains a denial-of-service vulnerability that an attacker could use to disrupt processes over a virtual machine. An adversary could exploit this bug by providing a special...

AMD Radeon Graphics Cards Open VMware Workstations to Attack

A remote code-execution bug exists in some configurations of the AMD Radeon graphics card that could allow an attacker to take control of a targeted system. The hack entails luring users of vulnerable systems to visit a specially crafted website that can deliver “a malformed pixel shader” to eith...

VMSA-2019-0006:VMware ESXi, Workstation and Fusion updates address multiple out-of-bounds read vulnerabilities

VMSA-2019-0006 VMware ESXi, Workstation and Fusion updates address multiple out-of-bounds read vulnerabilities. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2019-0006 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: VMware ESXi, Workstation an...

VMSA-2018-0025:VMware ESXi, Workstation, and Fusion workarounds address a denial-of-service vulnerability

VMSA-2018-0025 VMware ESXi, Workstation, and Fusion workarounds address a denial-of-service vulnerability VMware Security Advisory VMware Security AdvisoryAdvisory ID: VMSA-2018-0025 VMware Security AdvisorySeverity: Important VMware Security AdvisorySynopsis: VMware ESXi, Workstation, and Fusion...

Apple Intel HD3000 Graphics kernel driver patch

While the iMessage crypto bug got most of the attention among this week’s Apple patches, another vulnerability that was addressed represents a nasty trend of privilege escalation flaws that merit watching. Researchers at Cisco on Wednesday disclosed details on a flaw in an OS X graphics kernel...

Microsoft Windows SRV2.SYS SMB Negotiate ProcessID Function Table Dereference (MS09-050)

No description provided by source. Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference --------------------------------------------------------------------- Exploited by Piotr Bania // www.piotrbania.com Exploit for Vista SP2/SP1 only, should be reliable! Tested on: Vista sp2...

Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050)

Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference --------------------------------------------------------------------- Exploited by Piotr Bania // www.piotrbania.com Exploit for Vista SP2/SP1 only, should be reliable! Tested on: Vista sp2 6.0.6002.18005 Vista sp1 ultimate...

ESET Smart Security 3.0.667.0 - Privilege Escalation (PoC)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - Orange Bat advisory - Name : ESET Smart Security 3.0.667.0 Class : Privilage escalation Published : 2008-08-14 Credit : g g orange-bat com - - Details - File: easdrv.sys .text:00012B92 loc12B92: .text:00012B92 push ebp+InputBuf .text:00012B95 call...

[Full-disclosure] ZDI-07-046: Microsoft Windows Media Player Skin Parsing Size Mismatch Heap Overflow Vulnerability

ZDI-07-046: Microsoft Windows Media Player Skin Parsing Size Mismatch Heap Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-046.html August 14, 2007 -- CVE ID: CVE-2007-3037 -- Affected Vendor: Microsoft -- Affected Products: Windows Media Player 7.1 Windows Media Player ...

[Full-disclosure] ZDI-07-047: Microsoft Windows Media Player Malformed Skin Header Code Execution Vulnerability

ZDI-07-047: Microsoft Windows Media Player Malformed Skin Header Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-047.html August 14, 2007 -- CVE ID: CVE-2007-3035 -- Affected Vendor: Microsoft -- Affected Products: Windows Media Player 7.1 Windows Media Player 9...

[Full-disclosure] AOL Nullsoft Winamp S3M Module "IN_MOD.DLL" Remote Heap Memory Corruption

AOL Nullsoft Winamp S3M Module "INMOD.DLL" Remote Heap Memory Corruption by Piotr Bania [email protected] http://www.piotrbania.com Severity: Important - Potencial remote code execution. Software affected: Tested on AOL Nullsoft Winamp v5.33 x86 Feb 13 2007 on Windows XP SP1/SP2. Orginal url:...

[Full-disclosure] AOL Nullsoft Winamp IT Module "IN_MOD.DLL" Remote Heap Memory Corruption

AOL Nullsoft Winamp IT Module "INMOD.DLL" Remote Heap Memory Corruption by Piotr Bania [email protected] http://www.piotrbania.com Severity: Important - Potencial remote code execution. Software affected: Tested on AOL Nullsoft Winamp v5.33 x86 Feb 13 2007 on Windows XP SP1/SP2. Orginal url:...

[Full-disclosure] AOL Nullsoft Winamp LIBSNDFILE.DLL Remote Memory Corruption (Off By Zero)

AOL Nullsoft Winamp LIBSNDFILE.DLL Remote Memory Corruption Off By Zero by Piotr Bania [email protected] http://www.piotrbania.com Severity: Critical - Possible remote code execution. Software affected: Tested on AOL Nullsoft Winamp v5.33 x86 Feb 13 2007 on Windows XP SP1/SP2. There exist a...

kadu-fun.txt

Kadu Remote Denial Of Service Fun by Piotr Bania http://www.piotrbania.com All rights reserved. Original location: http://www.piotrbania.com/all/adv/kadu-fun.txt Severity: Medium - remote denial of service. Software affected: Tested on Kadu 0.4.3, others maybe also affected. 0. DISCLAIMER Author...

Microsoft Embedded OpenType Font Engine "t2embed" Remote Heap Overflow

/ oh my, bad luck, eEye released the advisory few minutes ago, and I've been researching this bug since about a week, sorry, it's cancelled / NOTE: this is super initial raport, if you expect some more info mail me for the bank account number... Microsoft Embedded OpenType Font Engine "t2embed"...

[Full-disclosure] Advisory: Apple QuickTime PICT Remote Memory Overwrite

Apple QuickTime PICT Remote Memory Overwrite by Piotr Bania [email protected] http://pb.specialised.info All rights reserved. CVE-ID: CVE-2005-2756 Original location: http://pb.specialised.info/all/adv/quicktime-pict-adv.txt Severity: Critical - remote code execution. Software affected:...

[Full-disclosure] Advisory: Apple QuickTime Player Remote Integer Overflow (1)

Apple QuickTime Player Remote Integer Overflow 1 by Piotr Bania [email protected] http://pb.specialised.info All rights reserved. CVE-ID: CVE-2005-2753 Original location: http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt Severity: Critical - remote code execution. Software affected...

[Full-disclosure] OllyDbg "INT3 AT" Format String Vulnerability

OllyDbg "INT3 AT" Format String Vulnerability by Piotr Bania [email protected] http://pb.specialised.info Original location: http://pb.specialised.info/all/adv/olly-int3-adv.txt Severity: High / Medium - code execution. Version affected: Probably all versions, tested on v1.10. I. BACKGROUND...

RealPlayer, Helix Player: Buffer overflow vulnerability

Background RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Helix Player is the Open Source version of RealPlayer. Description Piotr Bania has discovered a buffer overflow vulnerability in RealPlayer and Helix Player when processing malicious RAM files. Impa...